1. Who we are
Podway (“Podway”, “we”, “us”) provides cloud “pods” that run coding agents (such as Claude Code and Codex) you can reach from any browser. This policy covers podway.cloud and the Podway app. Podway is operated by Itzhak Lobak (an individual/sole proprietor), the data controller. A postal address is available on request at privacy@podway.cloud.
2. Information we collect
We keep this deliberately small. We collect:
- Account information — when you sign in with GitHub: your email address, name, and GitHub account identifier.
- Pod & usage metadata — pods you launch, their size and lifecycle (running/suspended), and coarse events (launched, updated, resized) so the product works and we can support you.
- Content you place in a pod — the code and files in your pod’s workspace, and your conversations with the agent, live on the pod’s persistent volume. We do not mine or train on them.
- Secrets — app secrets you set are stored encrypted and are write-only in the UI (never shown again). We never log or display their values.
- Support conversations — messages you send us through the in-app support chat.
- Product analytics — with your consent, how you use the app (pages, clicks, performance). Analytics are scrubbed of credential-shaped values, the terminal and secret inputs are excluded from any session recording, and we store the domain only for the fleet’s fetch-memory — never a URL, never page content, never who asked.
3. How we collect it
Directly from you (sign-in, launching pods, entering secrets, contacting support), and automatically through cookies/analytics only after you consent (see our Cookie Policy).
4. How we use it
- To provide and operate your pods and the app.
- To authenticate you and keep your account secure.
- To provide support and respond to your requests.
- To understand usage and improve the product (with consent).
- To detect, prevent, and address abuse, security, and fraud.
- To comply with legal obligations.
5. Legal basis for processing (GDPR)
We process account and pod data to perform our contract with you (providing the service), analytics on the basis of your consent, and security/abuse prevention on the basis of our legitimate interests. Where required, consent can be withdrawn at any time.
6. Sharing & third parties (sub-processors)
We don’t sell your personal information. We share it only with the providers we need to run the service:
- Fly.io — cloud hosting for pods and the app (region: Frankfurt, EU).
- PostHog — product analytics and support inbox (United States).
- Anthropic and OpenAI — the coding agents (Claude / Codex) you run, generally on your own subscription/login.
- GitHub — sign-in (OAuth) and, if you connect a repo, cloning it into your pod.
Each processes data under its own terms and our agreements. When an agent runs on your own Anthropic/OpenAI login, your relationship with that provider is directly with them.
7. International data transfer
Pods and the app are hosted in the EU (Frankfurt); some processors (e.g. PostHog) are in the United States, so some data is transferred internationally. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.
8. Data retention
We keep account data while your account is active and delete it within 30 days of account deletion. Pod content lives on your pod’s volume until you delete the pod. Operational logs are kept for up to 90 days. Coarse analytics are retained per our analytics provider’s settings. We may retain limited data longer where we must for legal reasons.
9. Your rights
Depending on where you live (EU/UK GDPR, California CCPA/CPRA, and others), you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. California residents may request that we not “sell” or “share” personal information — we do not. To exercise any right, email privacy@podway.cloud. You may also complain to your local data-protection authority.
10. Cookies & tracking
We set strictly-necessary cookies for the app to work (e.g. your session and your cookie choice). Non-essential analytics cookies run only after you accept them in the consent banner. Details are in our Cookie Policy.
11. Security
We use encryption in transit, encrypted storage for secrets, access controls, and design the product to minimise what we collect (for example, the terminal and secret inputs are excluded from analytics recording, and outbound analytics are scrubbed of credential-shaped values). No system is perfectly secure; we cannot guarantee absolute security.
12. Children’s privacy
Podway is not directed to children and is not intended for anyone under 16 (or the age of digital consent in your country). We do not knowingly collect data from children.
13. Contact
Privacy questions or requests: privacy@podway.cloud. Security reports: security@podway.cloud.
14. Changes to this policy
We may update this policy; we’ll change the “last updated” date and, for material changes, give reasonable notice. Continued use after changes take effect means you accept the updated policy.
15. Additional disclosures
We do not sell personal information. Third-party sites linked from Podway have their own policies. Governing law and jurisdiction are set out in our Terms.