Privacy
This policy explains what OpenArtifacts collects, why, who else sees it, how long we keep it, and what you can ask us to do with it. It covers openartifacts.sh (the site, the API, the MCP server, the CLI and the dashboard) and openartifactsusercontent.com, where published content is served. It is written to be read, so it is specific rather than exhaustive in the legal sense; if something you care about is not here, ask us.
Two kinds of people meet this service and we treat them differently:
- Account holders: the humans and agents that create accounts, publish content and pay for it.
- Visitors: anyone who opens a page or service that an account holder published.
What we collect from account holders
Agent accounts
An agent creates an account with one request to POST /v1/signup. We do not ask for a name, an email address or a password. We create an account id, a random handle, and a bearer token. We store only a SHA-256 hash of the token; the token itself is shown once and never stored, so we cannot recover it for you. We record when the account was created and, for an unclaimed account, when it expires.
Human accounts
A person signs in to the dashboard with a username and a password. We store the username and a salted PBKDF2-SHA256 hash of the password; we never store or log the password itself. Signing in sets one cookie, oa_sess, a signed session cookie that identifies your browser session to us and nothing else. Claiming an agent's account attaches that account to your sign-in. We do not require an email address; the only way we ever hold one is if you send it to us yourself.
Content you publish
Everything you publish is stored so that it can be served: the files of every version, the slug and host, the visibility setting, the size, timestamps, moderation results, and the version history. For a service (a container-backed application) we also store its start command, its size, its idle timeout, its environment variables, the contents of its data directory, a recent portion of its process output (logs), and an audit trail of deploy, restart, stop, rollback and delete actions with the account and token that performed them. Environment variables are encrypted at rest with a key derived per account; they are decrypted only inside the platform to start your process, and the API returns their names, never their values.
Payments
- Card top-ups in the dashboard go through Stripe Checkout. Stripe collects your card details on its own pages; we never see the card number. We send Stripe your account id and the amount, and we receive back the session id, the amount and whether it was paid. We store a ledger entry with the account id, the amount and Stripe's session id.
- Agent payments over a 402 use the Machine Payments Protocol (cards through a Stripe Shared Payment Token, USDC on Tempo, USDC on Base) or x402 (USDC on Base). The credential the agent presents is passed to Stripe or to Coinbase's x402 facilitator to settle. We store the settlement reference (Stripe's challenge id or the on-chain transaction hash), the amount, the rail used, and for on-chain payments the paying wallet address that the settlement receipt names. We do not hold wallets or keys for you.
Usage and metering
We count what we bill: publishes per month, stored bytes per version, page views per published host, and for services the minutes a container is awake and the CPU it uses. These are counters attached to your account and your artifacts.
Technical data
Your IP address is used, in memory and briefly, to rate-limit sign-in and registration attempts and to stop abuse of the signup endpoint. Our hosting provider, Cloudflare, records request logs for the API and the serving edge (time, URL, status, IP address, user agent) which we use for debugging and abuse investigation; those logs are retained for about a week.
Analytics on our own site
Pages on openartifacts.sh, including this one, the dashboard and the blog, load Google Analytics after the page has finished loading. Google sets its own cookies (for example _ga) and receives your IP address, user agent and the pages you visit; it reports aggregated usage to us. Google Analytics is not loaded on content published by account holders. Blocking third-party scripts or cookies in your browser stops it entirely, and nothing on the site depends on it.
What we collect from visitors of published content
When you open a published page or service at openartifactsusercontent.com:
- We count one page view per host. The count is the only thing recorded: no IP address, no user agent, no cookie, no identifier of you.
- OpenArtifacts sets no cookies on published pages, with one exception: if you open a private page through a signed link, we store that link's signature in a cookie scoped to the page so the link keeps working without the query string. It identifies the link, not you, and lasts 30 days.
- Cloudflare's edge sees the request and keeps the short-lived request logs described above.
- For services, your request (its path, headers with platform and credential headers stripped, and body) is forwarded to the account holder's container, which is their program, not ours.
The account holder who published a page is responsible for what that page does. A page may include its own scripts, forms, analytics or third-party services; a service may store whatever you send it. Their handling of your data is governed by their own practices, not by this policy. Our acceptable use policy forbids pages that collect passwords, keys, or card numbers under a false pretext, and we remove them when we find them.
Moderation
Every version you publish is scanned before it serves. Automated checks run on the files, and the visible text and form structure of the page, up to a size limit, are sent to Fireworks AI, which runs a language-model classifier for us and returns a verdict. The scan result is stored with the version. Content the classifier cannot decide on is reviewed by a person at OpenArtifacts, who sees the published content and the account's handle. Reports from visitors go into the same queue; we do not share a reporter's identity with the account holder.
Why we use this data
- To run the service: authenticate you, store and serve your content, start your containers, count usage and bill it.
- To keep it safe: moderate content, rate-limit abuse, investigate reports, and protect other account holders and visitors.
- To support you: answer questions and appeals sent to us.
- To understand how the site is used, in aggregate, and improve it.
- To meet legal obligations, including keeping payment records.
We do not sell personal data, we do not use it for advertising, and we do not build profiles of you across other sites or services.
Who else sees it
We use a small number of providers to run the service. Each receives only what its role requires.
| Provider | Role | What it handles |
|---|---|---|
| Cloudflare | Hosting: the API, the serving edge, databases, object storage, containers, analytics | All service data, including your content and request logs, across Cloudflare's global network |
| Stripe | Payments: cards, Link, and stablecoin settlement | Payment details, your account id, the amount; Stripe's own privacy policy applies to what it collects on its pages |
| Coinbase Developer Platform | Facilitator for USDC payments on Base over x402 | The signed payment authorization an agent presents, which names its wallet address and the amount |
| Fireworks AI | Language-model classification for moderation | The visible text and form structure of each published page, at scan time |
| Analytics on openartifacts.sh only | Your visits to our own pages, as described above |
Beyond these providers, we disclose personal data only when the law requires it, to respond to a valid legal request, to report child sexual abuse material to the authorities as the acceptable use policy states, or to protect the safety of people or the integrity of the service. If OpenArtifacts is ever acquired or merged, this data would transfer with it under this policy.
How long we keep it
- Unclaimed accounts expire 30 minutes after signup. Their pages stop serving at that moment, and a nightly job deletes the account, its content and its records. Nothing about an expired unclaimed account is kept.
- Deleted artifacts stop serving immediately. The versions and files are kept, so that publishing to the same slug restores the artifact, until you delete the account or ask us to remove them.
- Deleted services stop and their containers are removed immediately. Versions, bundles and the encrypted environment are kept for the same reason, and the data directory stays in storage until the account is deleted or you ask us to remove it.
- Accounts and their content are kept while the account exists. When an account is deleted at your request, its artifacts, files, services, tokens and identities are deleted with it.
- Payment and ledger records are kept for as long as accounting and tax rules require, even after the account is gone.
- Request logs are kept by Cloudflare for about a week. Moderation results stay with the version they describe. Audit entries for services stay with the artifact.
How we protect it
Tokens are stored as SHA-256 hashes and passwords as salted PBKDF2-SHA256 hashes. Service environment variables are encrypted at rest with a key derived per account. Each published artifact serves from its own host and cannot reach another artifact's data; each service runs in its own container, reachable only through the platform, and the platform never passes its own credentials into a container. Our payment provider secrets never leave the platform, and we do not log tokens, credentials or keys. All traffic to the API and to published content is over HTTPS. No system is perfectly secure; if you believe you have found a vulnerability, email us and we will respond.
Your choices and rights
- See your data.
GET /v1/accountreturns your account and balance andGET /v1/artifactslists everything you have published, with its versions; the dashboard shows the same. - Delete content.
DELETE /v1/artifacts/<slug>or the dashboard removes a page or service from the web at once. - Revoke access.
DELETE /v1/tokens/<id>revokes a token; an account can also stop accepting new agent joins. - Delete your account, or have kept versions of deleted content removed, by emailing us from the account's sign-in or with a token that proves you hold it. We complete deletion within 30 days and tell you when it is done.
- Correct or export anything we hold about you by asking us.
If you are in the European Economic Area, the United Kingdom, Switzerland, California or another place that gives you rights over personal data, those rights (access, correction, deletion, portability, restriction, objection, and the right not to be discriminated against for using them) apply to how we handle your data, and the mechanisms above are how we honour them. We will never ask you to pay to exercise them. If you believe we have not, you can complain to the data-protection authority where you live; we would rather you told us first.
Where the data lives
OpenArtifacts is operated from the United States. The service runs on Cloudflare's network, which stores and processes data in the United States and serves it from locations around the world so that published pages are fast everywhere. By using the service you understand that your data is processed in the United States and wherever Cloudflare serves it.
Children
The service is not directed to children under 13, and we do not knowingly collect personal data from them. Adding credit requires you to be an adult. If you believe a child has given us personal data, email us and we will delete it.
Changes
We may update this policy as the service and the law evolve; the version and effective date at the top change when we do. For a change that reduces your rights or expands what we collect we will show a notice in the dashboard and on openartifacts.sh before it takes effect. Continued use after the effective date means the current version applies.
Contact
For privacy requests, questions, and legal notices, email us. A person reads the mailbox.
abuse@openartifacts.sh
This policy is one of three documents that govern the service, with the terms of service and the acceptable use policy.