Privacy Policy

7 August 2026

Erawan hosts applications for the people who build them with a coding agent. This page says what we hold, why we hold it, and who else can see it. It is written to be read, not to be survived.

What we hold about you

• Your email address — typed at sign-up, or given to us by Google when you sign in with it.
• A Google account identifier, if you sign in with Google, so we recognise you next time. We do not store your Google password, and we never have it.
• The code you deploy, the container images built from it, and a git history of every version.
• Environment variables you set for your apps. These are encrypted before they are written down, and are decrypted only to run your app.
• Deployment history, build output and application logs.
• An audit trail of actions taken on your account. It records which environment variable keys changed, never what they were set to.
• A record of each email your app sends through us — recipient, subject and time — kept for quotas and, later, for billing.
• Access tokens for agents you have connected. These are stored as hashes, so a copy of our database does not yield a working token.

What we do not do

• We do not read the data inside your app's own database.
• We do not use analytics, advertising or tracking cookies. There is no third-party script on this site or in the console.
• We do not sell or rent anything about you to anyone.
• We do not take payments yet, so we hold no card details.

Cookies

Two, both first-party, both necessary. A session cookie that keeps you signed in, which your browser will not hand to any other site, and a companion cookie the console echoes back on every change so that a page on another site cannot make changes on your behalf. Signing out deletes both.

Who else can see it

That is the whole list. We will publish an update here before adding to it.

• Google — only if you choose to sign in with Google, and only to confirm who you are.
• Hetzner Online GmbH, in Germany — the servers everything runs and is stored on.
• Cloudflare — DNS for erawan.app and erawan.cloud, and mail forwarding for the addresses on this page.
• Let's Encrypt — certificates for the addresses your apps are served on.
• Resend — delivery of email your app sends through the email add-on. If your app does not send email, Resend sees nothing.

Where it lives

In Germany, on servers we rent. If you are outside the EU your data is therefore stored outside your country.

How long we keep it

For as long as your account is open. Delete an app and its images, environment variables and logs go with it. Records of email sent, and the audit trail, outlive the app they belong to — they are the evidence behind a quota — but they do not outlive the account: closing it removes those too.

Close your account from Settings and it goes, along with every app, database, file and log under it. It happens while you wait, not on a queue, and we keep no copy to restore from — so take what you want to keep before you do it. One line survives, recording that an account closed and when; it names nobody.

What you can ask for

A copy of what we hold about you, a correction, or deletion. Email hello@erawan.app and we will answer. If you are in Thailand, the PDPA gives you these rights; if you are in the EU or the UK, the GDPR does. We treat them the same way for everyone.

Security, honestly stated

Passwords are hashed with argon2. Environment variables and add-on credentials are encrypted at rest. Sessions are cookies your browser will not send to another site. Agent tokens are stored hashed and can be revoked from the console at any time.

Your code, its full version history and our own records are copied off the machine nightly, encrypted before they leave. Your app's database is not yet part of that copy, so keep your own export of anything you cannot afford to lose.

Changes

If this page changes in a way that matters, we will say so by email before it takes effect.

Contact

hello@erawan.app

Privacy · Terms · Report abuse · hello@erawan.app