Last updated 24 October 2026
Privacy Policy
In short
We keep only what we need to run Phinneas: your email, your apps, and a little about the devices your apps are installed on. We don’t sell data, we don’t show ads, and we don’t use tracking or analytics cookies.
You can download everything we have about you, or delete it, from Settings.
1.Who is responsible
Phinneas, an independent project run from India runs Phinneas and is responsible for the personal data described here. Contact us at support@phinneas.me.
2.What we collect from you
- Account: your email address, an optional display name, and your password (stored only as a secure hash by our login provider). If you turn on two-step login, the setup for it.
- Your apps: the code and files you add, the versions Phinneas prepares, app names and settings, groups, share links and invitations (including email addresses you invite).
- Connections: if you connect GitHub, an access token for the repositories you choose; keys you add for add-ons; connection keys for your AI tool (we store only a fingerprint of these, not the key itself). Secrets are encrypted.
- Activity: a record of important actions (like “app renamed” or “someone approved”) and sign-ins, kept so you can see what happened and to keep accounts safe.
- Support: anything you send us by email or through a report.
3.What we collect about people who install your apps
People who install an app you shared don’t need an account. For each install we keep: a random device identifier, the device type (for example Android or Windows), the device name they choose or you give it, when it was last used, and whether it’s approved. If they send a problem report or idea from the app, we keep that message.
The app owner can see this information. What the app itself does with data is up to the person who made it, not Phinneas.
4.Technical data
Like any website, our servers see IP addresses and basic browser information when you visit. We use these briefly to keep the service working and to stop abuse (for example, limiting how many requests come from one place). When something breaks, an error report (what went wrong, on which page, and basic browser details) is sent to our error-reporting provider so we can fix it. We use only essential cookies: to keep you signed in and to remember your light or dark setting.
5.Why we use it
- to run the service you asked for: store, prepare, deliver and update your apps;
- to keep accounts and devices safe and to prevent abuse;
- to send emails you need, like approval requests, build results and security alerts (you can turn most of these off);
- to answer you when you contact us;
- to meet legal duties.
6.Who we share it with
We use a small number of service providers to run Phinneas (hosting, database, email, build machines). They process data only on our instructions. The full list is on the Subprocessors page. We don’t sell personal data, and we share it with authorities only when the law requires it.
7.Where it is stored
Our providers may store and process data outside India, including in the United States and the European Union. We choose providers with strong security and contracts that protect the data.
8.How long we keep it
- Your account and apps: while your account exists.
- A deleted app: removed straight away, with backup copies expiring on their normal schedule.
- A deleted account: kept for 14 days so you can change your mind, then deleted. The activity history is kept without anything linking it to you.
- Security records (like blocked sign-in attempts): only as long as they help keep the service safe.
9.Your rights
You can, at any time:
- download your data (Settings › Privacy & legal);
- correct your name or email;
- delete your account (Settings › Delete account);
- turn off emails you don’t need (Settings › Notifications);
- ask us anything about your data, or complain, at support@phinneas.me.
Depending on where you live (for example under India’s Digital Personal Data Protection Act, or the GDPR in Europe), you may have further rights, including to complain to a data protection authority.
10.Security
Connections are encrypted, secrets are encrypted at rest, access is limited by per-account rules in the database, and you can turn on two-step login. No system is perfectly secure; if a breach affects you, we’ll tell you promptly.
11.Children
Phinneas accounts are for adults. Children may use an app a parent or guardian shares with them; the person sharing is responsible for that.
12.Changes
If we change this policy in a way that matters, we’ll tell you by email or in the app before it applies.
Questions? Write to support@phinneas.me.