Privacy policy

This policy explains what this EnvShare instance stores about you. If you self-host (run the app on your own servers), you are the operator: you choose the cloud accounts, and this policy is a template for what the software actually stores.

What we store

• Account. Email, display name, and (if you use Google) a profile photo URL from Google.
• Sign-in. A session cookie on your device, plus a list of signed-in devices (a label, IP address, and last seen time) so you can review sessions.
• Workspace data. Workspace name, members, pending invites, projects, environments, tokens (only a hash of the token is stored after you see it once), and audit events.
• Secrets. The key name, a short non-secret preview, version history, and the locked value (ciphertext, nonce, and auth tag). Plaintext is decrypted in memory on the server only when someone who is allowed asks for it.

Why we store it

To run the product: sign you in, show the right workspaces, encrypt and return secrets to people and tokens that are allowed, and keep an audit trail of important changes. We do not sell your data.

Encryption

Secret values are encrypted with AES-256-GCM (a lock that also checks the data was not changed) before they are written to Firestore. The encryption key lives in server environment variables. The browser never talks to Firestore. Encryption at rest does not hide data from people who already have access to the workspace.

Audit log

Create, update, delete, import, export, rollback, and CLI pulls that return values write an audit event (without the secret’s plaintext). Reveal and copy in the dashboard are not logged.

Who else sees data

• Your teammates. Members of a workspace can see what their role allows, including the audit log if they can open that page.
• Firebase (Google). Auth and Firestore hold accounts and encrypted records for this instance.
• Cloudflare Turnstile. If the bot check is on, Cloudflare sees that a human completed the check when you sign up or sign in. It does not receive your secrets.
• Email. Sign-in codes are sent to the address you give.
• Google sign-in. If you choose Continue with Google, Google shares the account details needed to create your session.
• Payment provider. Only if this instance charges a fee. Then the provider processes the payment. Workspace secrets are not sent there.

Platform admins (people who sign in at the operator console) can manage users and workspaces for this instance. They are not automatically members of your workspace.

Cookies

We use an httpOnly session cookie (a cookie your scripts cannot read) so you stay signed in. That is needed for the dashboard to work.

How long we keep it

Account and workspace data stay until they are deleted. Deleting a project removes its environments and secrets. Removing a member drops their access. There is no self-serve “delete my whole account” button yet: ask the operator of this instance, or a workspace owner to remove you from the team.

Your choices

• Update your name and review sessions in Account settings.
• Leave a workspace if an owner or admin removes you, or if you ask them to.
• Stop using the service and stop signing in.

Children

EnvShare is not for children under 16.

Changes

If this policy changes, we will update the date at the top. Keep using the service after that date means you have seen the new version. Related rules: Terms of use.