Privacy Policy
Speedle Cloud is operated by the Speedle team. Contact: contact@speedle.io.
法的文書は英語が正式な効力を持ちます。英語版が適用されます。
Your information belongs to you. This policy explains what Speedle Cloud collects and why, when we disclose it, how long we keep it and the choices you have. It covers this website, accounts and the hosted Speedle authorization service, including data you submit in policies or authorization requests.
Who is responsible
The Speedle team is responsible for the personal information processed in Speedle Cloud. Contact: contact@speedle.io. For personal information an application developer submits about its own users, that developer decides what to submit and why; contact that developer about its application’s use of your information.
Google user data: sign-in only
Speedle Cloud is a hosted access-control service for developers. Google sign-in is used only to create and identify the account that manages your services, policies and tokens, connect a sign-in method you choose and verify sensitive account actions. It does not import policy content or authorization subjects from Google.
We request only openid and email. We receive your Google account ID (sub), email address and email_verified flag, together with the authentication claims needed to validate sign-in. The verified flag must be true to proceed; we do not store it as a separate account field. We do not request Gmail, Google Drive, contacts, calendars or photos, or use or store your Google profile name or photograph.
We store your linked Google account ID and verified email snapshot with application-account identifiers and timestamps in Cloudflare D1. Verified identity details can also appear in short-lived signed, HttpOnly sign-in/confirmation cookies and temporary authentication records. Provider access and ID tokens are processed transiently during the callback and are not saved in the application database or application log fields. Account identity data is kept until you unlink that identity or delete the account, subject to the primary account email and residual records explained below.
What we collect and why
- Account information: provider user ID, verified email snapshot, application account ID, timestamps and GitHub login where supplied. We process the email-verified flag to validate sign-in. Purpose: create and authenticate your account and connect identities you choose. Basis: performing our service agreement with you; legitimate interests in preventing account takeover.
- Service content: service names, SPDL authorization and role policies, parsed policies and published policy snapshots. Authorization requests also contain the principals, resources, actions and attributes your application supplies. Purpose: manage policies, run the Playground and provide authorization decisions. Basis: performing the service agreement. Use pseudonymous principals where possible; do not submit secrets or unnecessary personal information.
- API tokens: token name, public ID, creation/revocation/usage metadata and a keyed verification hash. The secret is shown once on creation and stored as HMAC-SHA256 with a separate server-side token pepper. Purpose: authenticate calls for the owning service and support revocation. Basis: performing the service agreement and our legitimate interest in protecting it.
- Session, quota and audit data: hashed session identifiers, sign-in and activity times, identity/account/policy/token events, targets and keyed IP hashes; daily quota reservations and request tombstones support the free-plan limits. Purpose: maintain secure sessions, enforce limits, investigate misuse and show your audit history. Basis: performing the service agreement and legitimate interests in security and reliable operation.
- Operational telemetry: request identifiers, bounded route/method/status/provider/outcome categories, build version and timing. The approved monitoring rollout adds your authenticated Speedle Cloud account UUID to Analytics Engine request metrics for account-level usage, quota and reliability analysis; requests without successful authentication use the marker none. This is our application account ID, not your Google account ID. Metrics exclude service identifiers, email addresses, Google account IDs, policy text and request bodies. The application processes IP addresses for rate limiting and retains keyed IP hashes in security records. Cloudflare also handles network metadata such as IP addresses and browser headers to deliver and protect requests. Basis: legitimate interests in security, debugging, usage monitoring and availability.
- Public page analytics: the public pages use Cloudflare Web Analytics, which counts visits without cookies and without writing to browser storage. Cloudflare processes the requested page address, the referring page, an approximate location derived from the network request, and browser and device information, and reports aggregate visit counts to us. It does not run in the signed-in console, and we do not use it for advertising or profiling. Purpose: understand which public pages are used and improve the public site. Basis: our legitimate interests in operating and improving the public site.
- Correspondence: if you contact us, we receive your email address and the information you choose to include so we can answer and handle privacy requests. Basis: performing the service agreement where relevant, legitimate interests in responding, and legal obligations where a rights request or incident requires action. Do not send passwords, API tokens or health information.
We use the categories above only to deliver, secure and support Speedle Cloud and meet applicable legal duties. The application’s structured log fields do not contain authorization request bodies, SPDL source, email addresses, Google account IDs or provider tokens. That statement concerns application fields; Cloudflare’s network and platform records have their own processing rules.
Cookies and browser storage
We use strictly necessary Secure, HttpOnly session and temporary OAuth state, confirmation and completion cookies. Session cookies use SameSite=Strict; cross-site sign-in state cookies use SameSite=Lax where needed for the provider callback. CSRF protection also checks the request origin and a dedicated request header. There are no advertising or tracking cookies. Your selected language may be saved in localStorage; removing it resets that preference.
The public sample workspace uses built-in data and precomputed results, with no account, API evaluation or persistence. Visiting it does not submit sample principals to the authorization service. Operational telemetry described above still applies to requests that deliver the website or API.
When we access or disclose information
Cloudflare hosts Pages, Workers, D1, KV, the quota Durable Objects and Analytics Engine, and processes information to deliver and secure the service. Google and GitHub independently provide sign-in under their own privacy policies. The approved monitoring rollout uses Feishu for an owner-only operational digest containing account UUIDs, masked email addresses and usage estimates. Both the local and domain parts of emails are masked; masked emails are included only in that digest, not Analytics Engine metrics. Sending requires owner confirmation of recipients and message retention before activation. We do not sell personal information or disclose it for advertising. Access or disclosure is limited to providing the service, responding to a support request you initiate, protecting security, or complying with a binding legal requirement; Google data remains subject to the Limited Use commitments above. V1 does not send authentication email or use the deferred email-login service.
The support mailbox provider and its storage arrangements are not yet specified in this Beta policy. Ask us before sending sensitive correspondence.
Provider privacy policies: Cloudflare · Google · GitHub
Location and international transfers
Cloudflare operates a global network, so information may be processed outside your country. This Beta does not promise a specific storage jurisdiction. Cloudflare publishes a Data Processing Addendum describing international-transfer safeguards, including Standard Contractual Clauses. Google and GitHub’s sign-in processing follows their respective policies. Contact us before submitting data that needs a particular region or additional contractual terms.
Cloudflare Data Processing Addendum
Limited Use and prohibited uses
Google data is used only for sign-in, account identification, identity linking you request and sensitive-account-action verification. It is not sold, rented, shared with advertisers or data brokers, or used for advertising. We do not use it to develop, improve or train AI/ML models. Cloudflare processes it to host and secure these account functions; Google handles its own sign-in flow. Any legally required or security-related disclosure must also respect the Google API Services User Data Policy.
Your GitHub user ID, login and verified email are used only for sign-in, account identification, identity linking you request and sensitive-account-action verification; they are not sold, rented, shared with advertisers or data brokers, used for advertising, or used to develop, improve or train AI/ML models.
Speedle Cloud's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Human access to Google data is limited to the purposes allowed by the Limited Use requirements, such as a specific support request with your consent, security investigation or compliance with applicable law. It is never used for surveillance or to determine creditworthiness.
Speedle Cloud does not and will not use Google APIs, or any data obtained through Google APIs, to create, train, generate or distribute AI-generated non-consensual intimate imagery (AI NCII), or for any purpose prohibited by the Google APIs Terms of Service.
These commitments also apply under the Google APIs Terms of Service. Speedle Cloud provides authorization software, not image or video generation.
How we secure your information
We use HTTPS and HSTS (max-age=63072000, includeSubDomains), Secure/HttpOnly cookies, keyed HMAC-SHA256 hashes for sessions, IP records and API-token verification, tenant-scoped authorization and CSRF checks. Sensitive operations require recent authentication. Application permissions restrict each account to its own resources; audit events record security-relevant changes. Cloudflare documents automatic encryption at rest for D1, KV and Durable Object storage using Cloudflare-managed keys. These safeguards reduce risk; no system can guarantee absolute security.
If we learn of a personal-data breach that requires notice, we will notify the affected people and competent authority as required by applicable law, including the GDPR authority-notification deadline of 72 hours where it applies. We will provide available information about the incident and protective steps without undue delay.
Retention, deletion and remaining copies
Account, linked identities, services and policies are kept while the account exists. Successful self-service account deletion removes the active D1 account and its dependent identities, services, policies, token records and sessions in the deletion transaction. Revoked-token history remains while its account exists; revocation alone does not erase that metadata. Export your policies before deleting the account. Database removal is not a promise of simultaneous removal from all caches, audit records or recovery copies.
- Sessions stop being valid after 7 days of inactivity or 30 days from creation, whichever comes first. OAuth state and account-confirmation credentials last up to 10 minutes; completion credentials cannot outlive the original flow deadline. An hourly job removes expired authentication and session rows in bounded batches; a backlog or failure can delay physical erasure after validity has ended.
- The audit-history window is 180 days. An hourly cleanup job deletes security-audit records whose event timestamps are more than 180 days before that job's scheduled time, including records retained after account deletion. Each invocation deletes at most 5,000 audit rows in bounded batches. Backlogs, delayed jobs or failures can delay physical deletion; we do not guarantee erasure at the exact expiry time. This cleanup removes audit rows from active D1 storage and does not erase database recovery history. Quota-object state does not yet have a defined automatic post-deletion erasure deadline. Ask contact@speedle.io for help removing residual information; we do not promise a cleanup period that is not implemented.
- Token-verification cache entries are valid for at most 60 seconds from the original database check; policy snapshot caches are separate and do not inherit that expiry. A cache validity period is not a guarantee that every stored copy has been erased. When you delete your account or a service, we record only the deleted service UUID and timestamps in a cleanup record in the same database transaction. An hourly background job processes at most 100 pending cleanup records per run and repeatedly attempts to remove the corresponding published policy snapshot from active KV storage during a fixed 30-day window from deletion. Successful attempts do not extend that window. At expiry, the cleanup record becomes eligible for removal by the same limited job, and automatic snapshot-removal attempts stop. Failures, outages or a backlog can delay removal or prevent it during the window; we do not guarantee completion within one hour or 30 days. Snapshot publishers stop initiating writes after five minutes, but an already-started write cannot be cancelled. A pathological write that finishes after the 30-day repair window could restore a snapshot and require separate operator action. This cleanup does not immediately erase edge or isolate caches, security audit records, quota state, telemetry, messages or recovery history. Snapshots left by deletions before this cleanup was introduced require separate verified reconciliation.
- Analytics Engine request metrics, including account UUID attribution, are retained for three months under Cloudflare’s published limit. Deleting the D1 account stops future account lookups; it does not individually erase existing Analytics Engine events or automatically recall Feishu messages. The monitoring design limits personal shortlists, caches and outboxes to 24 hours, with digest outboxes limited to 6 hours; long-term monitoring snapshots contain aggregates only. Feishu message retention needs owner confirmation before activation. Workers Logs retention is plan-dependent: Cloudflare currently documents 3 days on Free and 7 days on Paid. Our exact live log settings and any exported copies need operator confirmation; we do not promise a shorter deadline. A fixed support-correspondence retention period has not yet been set for the Beta; contact us to request deletion.
- Cloudflare D1 Time Travel can retain recovery history for 7 days on Free or 30 days on Paid; SQLite-backed Durable Objects support up to 30 days of recovery. Deletion from active storage does not instantly erase this history. We have not defined an additional application-backup retention period or a guaranteed erasure deadline for recovery copies. Provider network/security records and Google or GitHub’s own records follow their respective policies.
Your rights and choices
You can export policies in SPDL or JSON, revoke API tokens, sign out one or all sessions, manage connected identities and delete your account in Settings after recent authentication. To request access, correction, erasure, portability, restriction or objection to processing based on legitimate interests, contact contact@speedle.io. We may need to verify that the request is yours. We will respond within one month, with any lawful extension explained within that month. Some records may be retained where law requires or permits it; we will explain an applicable exception.
You can disconnect Google in Settings if another sign-in method remains connected. Disconnecting removes that identity, not the whole account or its primary email. Removing Speedle Cloud in your Google Account does not erase our existing records; use account deletion or contact us for erasure.
You may complain to the supervisory authority responsible for data protection where you live or work, or where an alleged infringement occurred. These Beta terms do not take away mandatory privacy rights. For service content about an application’s users, you can also contact the developer who submitted it.
Manage connections in your Google Account
Children and health information
Speedle Cloud is intended for developers and is not directed to children under 16. If you believe a child has supplied personal information, contact us so we can investigate and handle deletion.
Speedle Cloud is not designed for protected health information (PHI). Customers must not submit PHI. We do not offer a Business Associate Agreement (BAA) and make no HIPAA-compliance claim.
Changes and questions
We will publish changes here with an updated effective date. Material changes will be highlighted on this page and through a console notice or direct contact where required before they take effect. If a new use of Google data needs consent, we will obtain that consent before using it for the new purpose.
Policy attribution and sources
Adapted and translated for Speedle Cloud from Basecamp’s open-source policies by 37signals. The structure and wording have been changed to reflect Speedle Cloud’s actual data, safeguards and Beta limitations.
Basecamp open-source policies · CC BY 4.0 · License
Cloudflare storage-security and retention documentation: