Privacy Policy
This Privacy Policy explains how aft.page ("aft", "we", "us", "our") collects, uses, stores and shares personal data when you use the aft.page website, web application, hosted deployment service and any related MCP or OAuth integrations, communications and support channels we provide.
1. Who we are
aft.page is a static site hosting service operated as a free beta. We are the operator and data controller for the personal data described in this policy. For any privacy question or request, contact [email protected].
2. The personal data we collect
We collect the following categories of personal data.
Information you provide directly
- your email address, when you log in, request early access, or claim a site
- the email address of a person you invite to view or edit a site
- files and content you upload to deploy, including website files and related metadata
- feedback and support messages you send to us
Information collected automatically
- authentication and session data
- site metadata such as slug, size, file count, timestamps and account association
- aggregate usage and activity data for deployments and page views. To approximate unique deployers we store a truncated one-way hash of your IP address; we do not store raw IP addresses in these metrics.
3. How and why we use personal data
We use personal data to:
- provide, operate and secure aft.page
- authenticate you and keep you signed in
- host, serve and manage the sites you deploy
- process anonymous site claims and team invitations
- send transactional emails such as login links, claim links and invitations
- prevent abuse, fraud, unauthorized access and service misuse
- enforce service limits and security controls
- comply with legal obligations and resolve disputes
- monitor and improve the service
4. Legal bases for processing
Depending on the context, we rely on one or more of the following:
- performance of a contract, where processing is necessary to provide aft.page to you
- legitimate interests, such as service security, abuse prevention, administration and improvement, where not overridden by your rights
- compliance with legal obligations
- consent, where required by law
Where consent is the legal basis, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.
5. Authentication
aft.page uses passwordless authentication: a magic-link email, or Sign in with Google. There is no password to store. Magic links are single-use and expire after 15 minutes. Google sign-in asks Google only for your verified email. Either path sets the same session cookie so you stay signed in for up to 30 days.
6. Hosted content and customer responsibility
aft.page is a static site hosting service. Files and content you upload may contain personal data, depending on what you choose to host. You are responsible for ensuring you have an appropriate legal basis and all necessary rights, notices and permissions for the content you upload and publish. If you make a site public, you are responsible for its content and any third-party technologies used on it, except for technologies that aft.page itself injects or controls.
7. Cookies and audience measurement
We use strictly necessary cookies for authentication. We do not use analytics or advertising cookies. Audience measurement for hosted sites is performed server-side and does not place any cookie or unique identifier on the visitor's device. See our Cookie Policy for details.
8. Sharing personal data
We may share personal data with:
- Cloudflare, Inc. — cloud infrastructure (Workers, storage, DNS and security) and transactional email delivery for login links, claim links and invitations ( cloudflare.com)
- Google LLC — if you choose Sign in with Google, so Google can authenticate you and return your verified email ( policies.google.com/privacy)
- professional advisers where necessary
- regulators or law enforcement where required by law or to protect rights, safety or security
- a successor in connection with a merger, acquisition or sale of assets, subject to appropriate safeguards
We do not sell personal data. If we add a service provider that processes personal data on our behalf, we will update this section.
9. International transfers
Some service providers may process personal data outside your country. Where we transfer personal data internationally, we rely on appropriate safeguards where required by law.
10. Retention
We keep personal data only for as long as necessary. In the current service:
- login sessions may persist for up to 30 days unless ended earlier
- login and claim links expire after 15 minutes
- invitations expire after 7 days
- uploaded site content is retained to serve your live URL until the site is deleted
- some security and audit records may be retained longer where necessary for compliance or abuse prevention
11. Security
We use technical and organizational measures intended to protect personal data against unauthorized access, loss, misuse or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Your rights
Depending on where you live, you may have rights including:
- the right to be informed and to access your data
- the right to rectification and erasure
- the right to restrict or object to processing
- the right to data portability
- the right to withdraw consent where processing is based on consent
- the right to complain to a supervisory authority
To exercise your rights, contact [email protected]. You can ask us to remove your email address or delete a site at any time.
13. Children
aft.page is not directed to children, and we do not knowingly collect personal data from children in breach of applicable law.
14. Third-party and hosted websites
aft.page may link to third-party services, and sites hosted by aft.page users may contain third-party links, code or content. We are not responsible for the privacy practices of third-party websites or user-uploaded content except where we expressly state otherwise.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and update the date above. Where required by law, we will provide additional notice.
16. Contact
For privacy questions or requests, contact [email protected].