Last updated: 1 August 2026
This policy explains how Sasa Dev Hostings collects, stores and uses your information when you use our hosting platform.
We collect account information you provide (name, email address), authentication data from Firebase (including your Firebase user ID and email-verification status), and connection metadata for GitHub (username, avatar, scopes). We also store application records you create: websites, deployments, environment variable keys, orders, support tickets and activity logs.
GitHub OAuth access tokens are encrypted with AES-256-GCM using a server-side encryption key before being stored. Tokens are used only to perform actions you request (listing repositories, publishing websites) and are never shown in the interface, sent to the browser, or included in API responses.
Your data is used to operate the platform: authenticate you, connect your accounts, import and deploy repositories, track deployment status, process Pro plan orders (including sharing your name, email and order details with our team over WhatsApp to confirm purchases), provide support, and keep the platform secure.
Application data is kept in secure managed storage controlled by the Sasa Dev Hostings operator, with access limited to the platform operator. Authentication is handled by Firebase. Deployment files are processed in memory during build preparation and published to your website subdomain; we do not keep copies of your repository files beyond the published bundle.
We do not store passwords in plaintext. Firebase handles password authentication directly. We never store Firebase private keys, GitHub tokens, or raw environment-variable values in plain text.
Firebase Authentication (Google), GitHub REST API, WhatsApp (for order messages you choose to send), and OSV (for dependency vulnerability checks). Each service has its own privacy policy.
You can disconnect your GitHub account at any time (removing the stored encrypted token), delete websites and deployments from the dashboard, delete your account by contacting support, and export or erase your data on request.
We apply server-side authorization, input validation (Zod), CSRF protection, rate limiting, security headers (CSP), encrypted token storage, and verified-email enforcement. No security measure is perfect; you are responsible for keeping your account credentials safe.
We may update this policy from time to time. Material changes will be announced through the platform.
For privacy questions, open a support ticket from your dashboard or message us on WhatsApp at 94767106413.