Privacy Policy

1. Who we are

AutoServer ("we", "us") operates the website, license dashboard, and install/download endpoints at autoserver.org. Contact: benkryd@gmail.com.

2. What this policy covers

This policy describes data processed by our site and license service. The AutoServer agent that runs on your VPS stores chat history, settings, and your LLM API keys on that machine under your control - we do not host your server chat content.

3. Data we collect

• Account: email and password hash for dashboard login
• License keys: key value, label, creation time, bind/unbind status
• Machine binding: hostname and machine fingerprint sent by the installer/core for license checks and heartbeats
• Technical logs: IP address, user agent, and request metadata may appear in server/access logs for security and abuse prevention
• Session cookies: used to keep you signed in to the dashboard (secure cookies when HTTPS is enabled)

4. What we do not collect (by design)

• Your OpenAI / Anthropic / Groq / Gemini / OpenRouter / Ollama API keys (those stay in your VPS .env)
• Chat messages and tool output from your AutoServer UI (stored on your VPS database)
• Payment card data during the free MVP (if billing is added later, this policy will be updated)

5. How we use data

• Authenticate you and manage license keys
• Bind keys to machines and authorize short-lived core downloads
• Operate, secure, and improve the site and license API
• Respond to support requests you send by email
• Enforce our Terms of Service

6. Sharing

We do not sell your personal data. We may share limited data with infrastructure providers (VPS, DNS, TLS) as needed to run the service, or when required by law. LLM providers receive prompts only from your VPS when you use BYOK - not from our license servers.

7. Retention

Account and key records are kept while your account exists and as needed for license enforcement and security. You may ask us to delete your account; we will remove or anonymize personal account data where practicable, except records we must keep for abuse prevention or legal reasons. Bound fingerprints may remain until Unbind/delete.

8. Security

We use HTTPS, hashed passwords, and session cookies. No method of transmission or storage is 100% secure. Protect your dashboard password and license keys. Prefer SSH tunnel or HTTPS for the VPS chat UI (see local access).

9. International users

Servers and backups may be located outside your country. By using the service you understand your data may be processed in those locations.

10. Children

AutoServer is intended for adults who administer servers. We do not knowingly collect data from children under 16.

11. Your choices

• Update or delete keys in the dashboard
• Sign out to end your session cookie
• Email us to request account deletion or a copy of account data we hold

12. Changes

We may update this Privacy Policy. The "Last updated" date will change when we do. Continued use of the site after updates means you accept the revised policy.

13. Contact

Privacy questions: benkryd@gmail.com.