Nodify.Me

Privacy Policy

Effective 6 November 2026

Nodify.Me is a monitoring and app-deployment tool for servers that you own and pay for. This page says what we store about you and your servers, what we do not, who else sees it, and how long we keep it. It is written to match how the service actually works.

The short version

  • We store your account details and the information your servers report so we can show it to you: health, resource use, installed software, containers and the apps you deploy through us.
  • We do not read or store your servers' files, your databases, or your applications' data. We do not store your containers' environment variables.
  • We keep no standing SSH access to your servers. The one-time login used to install our agent is held in memory while it installs and is never saved.
  • No advertising, no analytics or tracking scripts, no third-party trackers, and we do not sell personal information.
  • You can ask us to delete your account and its data at any time.

What we collect

Your account

  • Your email address, and your name if you give one.
  • Your password, stored only as a salted bcrypt hash. We cannot read it, and no one at Nodify.Me can see it.
  • Your time zone if you set one, your team memberships and role, and your email notification choices.
  • Your sign-in sessions (an identifier and an expiry) and, if you turn on two-step sign-in, an encrypted authenticator secret and hashes of your recovery codes.
  • Whether you have verified your email address, and when. The verification link we email you is stored only as a hash, and expires.
  • A simplified form of your email address (lower case, without any +tag, and without the dots Gmail ignores). It is used only to give one free trial per mailbox, never to sign you in or contact you.
  • When you change your sign-in email, reset a password or reset two-step sign-in: a record of the request.
  • If an administrator of Nodify.Me acts on your account (for example changes your plan or sends a password reset), a record of who did what and when.

The servers you add

  • The name, IP address and SSH port you enter, and any notes you write about the server.
  • What our agent reports from the server: the operating system and version, host name, uptime, time zone, installed software and versions (such as Docker, nginx, Certbot, Node.js, Git), and security settings (for example whether a firewall or automatic updates are on).
  • Resource use: CPU, memory, disk and swap for the server and, for each Docker container, CPU and memory.
  • For each container: its name, image, status, published ports, Docker labels, restart count, health and exit information. Container environment variables are never sent to us, and we discard them if an agent were to.
  • An agent access token, stored as a hash.

Apps and websites you deploy through us

  • The name, image, domain and settings you choose.
  • Values you give us to run an app (such as environment variables) and registry access tokens are stored encrypted, are never shown back to you, and are sent to your server only when needed.
  • SSH keys you choose to save in your key vault are stored encrypted. Saving one is optional.

What you ask us to do

  • Actions you start from the web app (deploy, restart, view logs, change a setting): the action, its settings, its progress and its result. Log lines you ask to view are part of the result and are kept with that job's history.
  • Alerts and notifications about your servers, and when you acknowledged them.

Email we send you

  • A record of each message: the address, the kind of message, the subject and whether it was delivered. The body is deleted once the message has been sent.
  • An address that bounces or reports us as spam is remembered so we do not keep mailing it.

Technical information

  • Our server logs record sign-in and security events with your email address, IP address and browser description, and errors. We use them to protect accounts and to fix problems.

What we do not collect

  • The contents of your servers: files, databases, volumes and the data your applications handle.
  • Your containers' environment variables.
  • The root or SSH password or private key used once to install the agent. It lives in memory during the install and is never written to our database or logs.
  • Payment card numbers. When paid plans are offered, payments are handled by Stripe and we never see your card.
  • Any information for advertising, profiling, or tracking you across other websites.

Cookies and local storage

We use only what is needed to keep you signed in and remember your display choice:

  • Two sign-in cookies (access_token and refresh_token): essential, HTTP-only (scripts cannot read them), and sent only to Nodify.Me. A session lasts 24 hours, or 30 days if you choose “remember me”.
  • Local storage in your browser: your light or dark theme, and a copy of your basic profile (name, email, role) that speeds up page loads. The copy is removed when you sign out.

There are no advertising, analytics or tracking cookies.

How we use it

  • To provide the service: show your servers, run the actions you ask for, and send the alerts you enable.
  • To keep accounts and servers secure and to investigate abuse.
  • To send account and security email (sign-in codes, password resets, changes to your account) and, if you allow it, alert and notice email.
  • To answer you when you contact us.

Where the law asks for a legal basis, ours are: running the service you signed up for, our legitimate interest in keeping it secure, and your consent where we ask for it (for example optional email).

Who else handles your information

We share information only with the services we need to run Nodify.Me:

  • Our server hosting provider, which runs the machines the service lives on.
  • Our email delivery provider (Amazon SES), which delivers the email we send you.
  • If you choose to sign in with GitHub or Google when that is offered: we receive your name, your verified email address and an account identifier. We never receive your password there and we do not keep the provider's access tokens.
  • When paid plans are offered: Stripe, for payment and billing.

We do not sell personal information and we do not share it for advertising. We may disclose information if the law requires it.

How long we keep it

  • Your account and servers: until you delete them or ask us to delete your account.
  • Server and container measurements: a limited time that depends on your plan, from 3 to 14 days, then deleted automatically.
  • Sign-in sessions: 24 hours, or 30 days with “remember me”; password reset and sign-in code links expire within hours.
  • Job history, alerts, notifications and email records: kept while your account exists, and removed when a server or your account is deleted.
  • Database backups: kept for a few days and then replaced.
  • Server logs: kept only as long as needed for security and troubleshooting.

Removing a server deletes its measurements, containers, apps and history from our systems. Backup copies age out as above.

Security

  • All traffic to Nodify.Me uses HTTPS.
  • Secrets we must hold are encrypted at rest; passwords are hashed.
  • Two-step sign-in with an authenticator app is available, and required for our administrators.
  • The agent on your server connects out to us. We run only a fixed list of named actions on it, never free-form commands, and we do not keep SSH access to your server.

No system is perfectly secure, and we cannot promise it. If something affects your data we will tell you.

Your choices and rights

You can see and correct your details in Settings, remove servers, apps and saved keys yourself, and choose which email you receive. You can ask us to give you a copy of your information, to correct it, or to delete your account and its data. Depending on where you live (for example the EU, the UK or California) you may have further rights, including to object to or restrict how we use your information; we will honor them. We do not sell or share personal information for advertising.

Children

Nodify.Me is a tool for people who run servers. It is not meant for children under 16, and we do not knowingly collect their information.

Changes

When this page changes, the effective date above changes with it. If a change matters to you (for example a new kind of information we collect), we will email you before it takes effect.

Contact

Questions, requests to see or delete your data, or concerns: legal@nodifyme.app.