Privacy policy
This Privacy Policy explains how the Cloche service (“Cloche,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you visit cloche.dev, create or use a Cloche account, or use applications hosted through Cloche.
Cloche is a software service currently operated from Israel by an individual. Cloche is not currently operated by an incorporated legal entity. The operator of Cloche is the controller of the information Cloche collects for its own purposes and can be contacted at hi@cloche.dev.
Cloche provides infrastructure that allows users to publish, host, share, and operate applications, including applications created using artificial intelligence tools.
An important distinction runs throughout this Policy: Cloche provides the platform and infrastructure, while users create and control the applications they publish through it.
1. Information We Collect
Account information. When you create or access a Cloche account, we may collect information such as your email address, authentication information, organization or workspace information, and information provided by authentication providers.
We may also maintain information necessary to manage your account, sessions, permissions, and access to applications.
An email address, or a Google account that provides one, is required to create an account. Without it you cannot sign in. Optional analytics are never required to use Cloche.
Application information. When you publish an application through Cloche, we may store the files, code, configuration, metadata, permissions, versions, and other information necessary to host and operate that application.
Information processed through user applications. Applications hosted on Cloche may allow their users to submit, upload, generate, store, display, or otherwise process information.
The creator or operator of an application determines what information the application requests, collects, or processes and for what purposes.
Cloche does not determine what information a user-created application asks its users to provide and does not endorse, review, verify, or approve the information collected through such applications.
If you create or operate an application through Cloche, you are responsible for ensuring that your collection and use of information through that application complies with applicable privacy and data protection law.
If you provide information to an application hosted on Cloche, you should understand that the application was created and is controlled by its creator or operator. Questions about why an application requests particular information should generally be directed to that application’s creator or operator.
Sharing and permissions. When an application is shared, we may store information about invitations, users who have been granted access, permissions, access links, and related settings.
Technical information. We may automatically collect technical information necessary to operate, secure, diagnose, and improve Cloche, including IP addresses, timestamps, browser and device information, request information, error information, security events, and similar logs.
Cookies and optional analytics. Essential cookies keep you signed in, help protect your account, and remember your cookie choices. With your consent, we use an analytics provider based in the European Union on Cloche’s website and dashboard to measure page visits, actions, and setup steps, count dashboard problems by type and page category, and record dashboard visits so we can find problems and improve the service. When you sign in, we associate this activity with an account identifier; we do not send the analytics provider your name or email address.
Session recordings run only on the dashboard. They mask page text and form inputs and are kept for 30 days. Dashboard problem counts contain only a fixed problem type and page category, never error names, messages, stacks, page addresses, or the contents that caused a problem. Automatic error collection stays off. We do not enable console-log or network-payload recording. Cloche does not load these browser analytics or recordings in user-created applications.
You can accept or reject optional analytics, or change your choice through in the website footer. Optional browser analytics and recordings stay off until you accept. Your choice is shared between cloche.dev and dashboard.cloche.dev and remembered for six months. Turning analytics off stops future collection and clears analytics cookies and browser storage on the current site; it does not delete information already collected.
Website requests. Our server records each page request to Cloche’s website, whatever your cookie choice: the page address, including any campaign tags in it but no other part of the link, the website that linked you there, your browser type, and your IP address. Our analytics provider uses the IP address only to estimate your country, then discards it. These records use no cookies and store nothing on your device, and they are never linked to your account.
We also collect limited service events and website request statistics directly through our service. These do not depend on optional browser analytics cookies and are used to operate and improve Cloche. They include a count of when a user-created application is opened: which application and organization, and how the visitor got in, such as through a share link, an invitation, or because the application is public, and whether the visitor owns it. The count never includes who the visitor is, the application’s address, or anything in the application. Our service makes the count, and the application itself loads nothing for it.
2. How We Use Information
We may use information to:
- provide, operate, maintain, and improve Cloche;
- authenticate users and manage accounts;
- host and deliver applications;
- enforce application permissions and sharing settings;
- send authentication codes, invitations, service notices, and other operational communications;
- prevent fraud, misuse, abuse, and security incidents;
- diagnose technical problems;
- understand use of Cloche and improve the service;
- provide support;
- enforce our policies;
- comply with legal obligations and lawful requests; and
- protect the rights, safety, security, and integrity of Cloche, our users, and others.
We do not sell personal information.
Legal bases. Where the law requires a legal basis for processing, we rely on:
- performance of our contract with you, to provide your account, sign-in, hosting, sharing, and service communications;
- your consent, for optional analytics and session recordings, which you can withdraw at any time through Cookie preferences;
- our legitimate interests in operating, securing, diagnosing, and improving Cloche, for technical logs, security events, service events, and request statistics; and
- compliance with legal obligations, where the law requires us to keep or disclose information.
Cloche does not make decisions about you that produce legal or similarly significant effects by automated means alone.
3. User-Created Applications and Content
Cloche is a hosting and distribution platform. Applications and content made available through Cloche are created, uploaded, configured, or controlled by users.
We do not routinely review, monitor, approve, verify, or endorse user-created applications or the information, functionality, outputs, claims, or materials contained in them.
The availability of an application through Cloche does not mean that Cloche created, reviewed, or approved that application.
Application creators decide what their applications collect, how that information is used, and who can access it.
Users should exercise their own judgment before providing personal, confidential, sensitive, financial, medical, proprietary, or other information to a user-created application.
4. Our Role When Applications Process Personal Information
For information Cloche collects for its own purposes, such as account information, platform security information, and certain analytics, Cloche determines how and why that information is processed.
For information collected through an application created and operated by a Cloche user, the application creator or operator generally determines what information is collected and why it is collected. Cloche generally processes that information to provide the hosting, storage, execution, access-control, and related infrastructure requested by the application creator.
Depending on the circumstances and applicable law, this may mean that the application creator acts as the controller or equivalent responsible party for that information and Cloche acts as a processor, service provider, holder, or similar infrastructure provider on its behalf. The terms under which we process that information are in Section 5 of our Terms of Service.
Nothing in this Policy changes the respective responsibilities imposed on Cloche or an application creator by applicable law.
6. Service Providers
We use third-party service providers to operate Cloche. These may include providers of cloud infrastructure, content delivery, storage, authentication, email delivery, security, monitoring, and analytics services.
Our providers are:
- Google Cloud, which runs Cloche and stores account information and application information;
- Cloudflare, which carries traffic to Cloche and to applications, stores application files and backups of application information, and delivers Cloche’s email;
- WorkOS, which handles sign-in and issues sign-in codes; and
- an analytics provider based in the European Union, which provides the optional analytics and receives the service events and website requests described in Section 1, and never receives information stored in or submitted through user-created applications.
Google Cloud and Cloudflare are the sub-processors for information we process on behalf of application creators, as described in Section 5 of our Terms of Service. These providers process information on our behalf only where necessary to provide their services.
Our service providers and infrastructure may operate in countries other than the country in which you are located. As a result, information may be processed or stored outside Israel or your country of residence, subject to applicable legal requirements.
We may change, remove, or add service providers as Cloche develops. We update this list at least 30 days before a new provider starts processing application information on behalf of application creators. You can ask us which analytics provider we use through the contact details below.
7. Disclosure of Information
We may disclose information:
- to service providers that help us operate Cloche;
- according to permissions and sharing choices made by application creators;
- when you instruct or authorize us to do so;
- where reasonably necessary to investigate fraud, abuse, security incidents, or violations of our policies;
- to protect Cloche, our users, or others;
- in connection with a financing, acquisition, merger, incorporation, reorganization, sale or transfer of the service or its assets, or similar transaction; or
- where required or permitted by applicable law, regulation, legal process, or governmental request.
We do not sell personal information to advertisers.
8. International Processing
Cloche operates from Israel and uses service providers and infrastructure that may process information in Israel, the United States, the European Economic Area, or other jurisdictions.
The European Commission has recognized Israel as providing an adequate level of protection for personal data transferred from the European Union. Where information is transferred to a service provider in a country without such a recognition, such as the United States, we rely on the safeguards that provider offers, such as the Standard Contractual Clauses approved by the European Commission or the EU-U.S. Data Privacy Framework. You can ask us for more information about these safeguards at hi@cloche.dev.
9. Data Retention
We retain information for as long as reasonably necessary to provide Cloche, maintain security and business records, comply with legal obligations, resolve disputes, and enforce our agreements.
Account information and application information are kept while the relevant account or application remains active. Technical logs and security records are kept for a limited period needed to secure and diagnose the service, and are then deleted on a rolling basis. Backups of application information are kept for 30 days, and other backups are replaced on a similar rolling schedule, so information deleted from active systems leaves backups as they are replaced. When an application is deleted, a copy of its information is retained for 90 days so it can be restored if the deletion was a mistake, and is then deleted. Session recordings are kept for 30 days.
Deleting an application or account may cause associated information to be deleted from active systems, but copies may remain temporarily in backups, logs, security records, or other systems where immediate deletion is technically impractical or where retention is required or permitted by law.
Deletion from active systems does not necessarily result in immediate deletion from all backup systems.
10. Security
We use technical and organizational measures intended to protect information processed through Cloche.
However, no online service, hosting platform, application, database, or transmission method can be guaranteed to be completely secure.
We therefore cannot guarantee that unauthorized parties will never defeat our security measures or access, use, alter, or disclose information.
The security of an application also depends on how its creator designed, configured, and shared it.
11. Sensitive Information
Cloche does not ask for sensitive or specially regulated information for its own purposes.
Whether an application collects sensitive or specially regulated information is decided by its creator.
12. Your Rights and Choices
Wherever you live, you can ask us to:
- give you access to the personal information we hold about you;
- correct information that is inaccurate or incomplete;
- delete your information;
- restrict how we process your information;
- give you a copy of information you provided to us, in a structured, machine-readable format; and
- stop processing your information where we rely on our legitimate interests, unless we have compelling grounds to continue.
Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing that happened before you withdrew it.
Requests concerning information collected directly by Cloche can be sent to hi@cloche.dev.
If your request concerns information collected by a user-created application, we may direct you to the creator or operator of that application where they are responsible for the relevant processing. Where appropriate, we may assist application creators in responding to valid requests.
We may need to verify your identity before fulfilling certain requests.
You also have the right to complain to a data protection authority: in Israel, the Privacy Protection Authority, and in the European Union, the authority in the country where you live or work, or where you believe a violation took place.
13. Children
Cloche is not intended for children under 16, and we do not knowingly offer Cloche directly to children under 16.
If you believe information about a child has been collected improperly through Cloche, contact us at hi@cloche.dev.
14. Third-Party Services and Integrations
Applications hosted through Cloche may connect to third-party websites, APIs, artificial intelligence services, databases, or other services.
Those third parties operate independently from Cloche, and their own terms and privacy policies govern the information they receive.
15. Changes to This Policy
We may update this Privacy Policy from time to time as Cloche, our practices, and applicable requirements evolve.
The “Last updated” date above indicates when this Policy was most recently revised.
Where appropriate, we may provide additional notice of material changes.
16. Applicable Law
This Privacy Policy and Cloche’s processing activities are subject to applicable law, including Israeli privacy and data protection law and, where it applies, the EU General Data Protection Regulation.
Nothing in this Policy limits rights or obligations that cannot lawfully be limited.
17. Contact
Questions, requests, or complaints concerning privacy can be sent to:
Cloche is currently operated from Israel and is not currently operated by an incorporated legal entity.
If operation of Cloche is transferred to a legal entity in the future, this Privacy Policy may be updated to identify that entity as the operator of the service.