Last updated 10 August 2026
The short version. Allocus stores your GitHub username and one email address for service notices. Not your name, not your card, nothing else about you. Nothing is sold, shared for advertising, or fed to an analytics company. There are no tracking cookies. Your servers run in Paris, France.
The long version below says exactly which rows exist in the database and why, because "we value your privacy" is not a fact anyone can check.
Allocus is operated by Henning Holgersen, an individual developer based in Norway. There is no company behind Allocus yet — no AS, no Ltd, no Inc. The data controller under the GDPR is therefore a private individual, and that individual is the person who answers when you email support.
Contact: support@allocus.dev
Norway implements the GDPR through the EEA agreement, so you have the same rights here as you would with an EU-based provider.
This is the complete list. Each row is something that genuinely exists in the control-plane database or is genuinely written to a log.
| What | Why it exists | How long it's kept |
|---|---|---|
| Your GitHub username | It is your account. Sign-in requests only the read:user scope, and only the username is read from the response — your email, real name and avatar are never stored. | Until you delete your account |
| One contact email address | The only way to reach you. Required, because several promises in the Terms — telling you about a security incident, a price change or the service closing — cannot be kept otherwise. You supply it directly; it is not taken from GitHub. Used for those notices and nothing else: no newsletter, no product marketing, and it is never passed on. | Until you delete your account |
| API key and box credential hashes | Authenticating the CLI and your server. Only SHA-256 hashes are stored; the plaintext key is shown to you once and never again, and cannot be recovered from what's stored. | Until revoked or the account is deleted |
| Your box's name, status and IP address | Running and routing your server, and pointing DNS at it. | Until the box is torn down |
| App config values (secrets) | The environment variables your apps need. Encrypted at rest and delivered to your box only at deploy time. | Until you delete them or the account |
| Deploy records | App names, container image digests and the compose descriptor for each deploy — the queue your server reads from. | Deleted when the box is torn down |
| Server load samples | Box-wide CPU, memory and disk, about once a minute, so the dashboard can tell you when it's time to size up. No per-process or per-request detail. | A rolling window of roughly four hours |
| Command output | When you run something like allocus logs, the result passes through the control plane so your firewalled box can answer you. Whatever your app prints to its logs is in there. | Until superseded or the box is torn down |
| Billing references | A Stripe customer id, a subscription id, and a status. No card number, no billing address, and no email address — those live with Stripe and are never sent to Allocus. | Account lifetime, then as tax law requires (see §6) |
| Abuse reports and enforcement records | If someone reports content on your box, the report and what was decided about it are kept — including the reporter's name and address, and the reason recorded against any account that was restricted. Needed to act on reports, to explain a decision to the person affected, and to handle a challenge or an authority's request. | Report and decision: 2 years. Data belonging to a removed app: 90 days |
| Server request logs | Ordinary web-server logs at the hosting layer, which include IP addresses. Used for debugging and abuse investigation, never for profiling. | Short-lived, per the hosting provider's retention |
One cookie: a signed session cookie that remembers you're logged in. It is not used for tracking, it is not read by anyone else, and it disappears when you sign out.
There is no Google Analytics, no advertising pixel, no session recorder, no A/B testing tool and no third-party script that watches you use the site. This is why Allocus has no cookie banner — there is nothing to consent to.
Three third parties touch data, and no others:
| Who | Role | What they see | Where |
|---|---|---|---|
| Scaleway | Data processor — hosting | Everything that runs: your box, its disk, the control-plane database, DNS. | Paris, France (fr-par) |
| Stripe | Payment processor, and its own controller for payment data | Your name, email and card details, collected directly on Stripe's checkout page. Allocus receives only the ids and the subscription status. | EU/US, under Standard Contractual Clauses |
| GitHub | Identity provider you choose to use | That you signed in to Allocus, at the moment you do it. | US, under Standard Contractual Clauses |
Off-site backups of the control-plane database are also held in Microsoft Azure, in the EU, so that a serious incident at Scaleway cannot destroy both the service and the means to rebuild it.
When a box is torn down, its deploy queue, command history and load samples are deleted along with it. Your saved app config is deliberately kept, so a rebuilt box works again without you re-entering everything — ask, and it goes too.
Reports of illegal content are handled under the abuse procedure. If you send one, your name and address are used to follow it up and are normally shared with the customer concerned, because they're entitled to know the case against them — say so if you believe that would put you at risk, and it will be weighed. Reports about child sexual abuse material or terrorist content can be made without identifying yourself.
If something you host is reported, you're told what was decided and why. Where the law requires it, reports and the resulting data may be passed to the police or another competent authority.
If you deploy an app that handles other people's personal data, then you are the controller of that data and Allocus is your processor. The commitments that go with that role — sub-processors, security, breach notification, deletion — are set out in the data processing section of the Terms, which forms our processing agreement.
Allocus is early-stage software run by one person. It is built carefully, but it has not been independently audited, and it would be dishonest to imply otherwise.
You can ask for a copy of your data, correct it, delete it, take it elsewhere, or object to a particular use. Email support@allocus.dev and a person — the same person who runs the service — will handle it, normally within a few days and always within one month.
If you think your data has been handled badly, you can complain to the Norwegian Data Protection Authority (Datatilsynet), or to the supervisory authority where you live.
If this policy changes in a way that affects you, the date at the top changes, you get an email at the address on your account before it takes effect, and the change is posted on the public service notices page. Older versions are visible in the project's git history.