Privacy policy
Effective [to complete: effective]
This policy explains what personal information Les Services FullStacked collects through the FullStacked app, FullStacked Cloud, our websites (fullstacked.org, fullstacked.cloud, fullstacked.ca) and our professional services, why, and the rights you have. We follow Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA.
Who we are
Les Services FullStacked, operated by Charles-Philippe Lepage, [to complete: address].
Our person in charge of the protection of personal information is Charles-Philippe Lepage. Write to [email protected] for any question or request about your personal information.
The FullStacked app
The FullStacked app (App Store, Google Play, Microsoft Store, Linux and the npm package) does not collect personal information. It contains no analytics, advertising or crash-reporting code and makes no network request by itself.
- Your projects, your shell history and the Git credentials you enter are stored on your device only, in the app's folder. Git credentials are kept in a file readable by the app; protect your device accordingly. On Android, your device's backup settings may include the app's files in your backups to your Google account.
- The app connects to the Internet only when you ask it to: installing npm packages (npm registry), using Git with a remote (for GitHub, through GitHub's device sign-in), running a script from a URL, or running a project that makes its own requests. Those services apply their own privacy policies.
- The store you downloaded the app from (Apple, Google, Microsoft) may collect information under its own policy.
Our websites
Our websites use FullStacked Insights, our own measurement tool, to learn which pages and messages are useful. It records:
- the page visited, its language and the referring website (its domain only);
- campaign tags in the link (utm_source, utm_medium, utm_campaign);
- the type of device (phone, tablet or computer), not its model;
- clicks on buttons and links, how far down the page you scroll, and which version of a page you saw when we test two versions (A/B testing);
- a random identifier stored in your browser's local storage, so a visit counts once and you keep seeing the same version of a page.
It uses no cookies, does not record your IP address (used only for a moment to block abuse, then discarded), does not identify you and does not follow you on other websites. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is sent. You can also clear the identifier by clearing your browser's storage for our sites.
These records are kept for 13 months, then deleted, on a server located in [to complete: insightsHosting].
When you write to us (for example to book a meeting), we use your name, email address and message to answer you.
FullStacked Cloud
What we collect
| Information | Why |
|---|---|
| Account: email address, name, username, profile picture and the sign-in method you choose (password, email code, Google, GitHub, Microsoft, Apple, passkey) | Create and secure your account, sign you in |
| Content you put in the service: Git repositories, project files, managed databases and file storage, actions and their output | Provide the service you ask for |
| Sharing: invitations you send (including the email address of the person invited), groups and permissions | Give the right people access |
| Devices that run the FullStacked Cloud client: a device identifier, the name you give it, platform, versions | Show your devices and keep the client up to date |
| Security records: sign-ins, token creation and revocation, permission changes and similar events, with the IP address used | Protect accounts, investigate abuse, meet legal obligations |
| Tunnels: connection times, amount of data transferred, and the IP address of the device that connects | Run tunnels, apply plan limits |
| AI agents connected through MCP: the tools they call, with secrets masked and long values shortened | Let you review what agents did on your behalf |
| Billing: plan, subscription status and invoices (name, email, amounts) | Bill the Pro plan |
| Technical logs and errors | Keep the service running |
We do not inspect or record the content that passes through tunnels, and we do not use your content to train AI models or for advertising.
Sign-in and browser storage
The Console keeps your session in your browser's session storage, which is cleared when you close the tab. FullStacked Cloud sets no advertising or analytics cookies. Our sign-in provider (Clerk) may set cookies needed for signing in on its pages.
Service providers
We share personal information only with providers that help us run the service, under contract, and only what they need:
| Provider | Purpose | Location |
|---|---|---|
| Clerk | Sign-in, account security, subscription billing and payments | United States |
| Resend | Emails we send (invitations, plan and quota notices) | United States |
| Cloudflare | Domain names, encryption in transit, protection against attacks | Global network |
Some of these providers process information outside Québec. Before doing so we assess whether the information will be adequately protected, as Law 25 requires.
If your organization gives you access through its own identity provider, that organization shares your user identifier, name, email and groups with us so we can apply its permissions, and it can see the access it manages.
We may disclose information when the law requires it. We never sell personal information.
Where it is stored
FullStacked Cloud servers are located in Québec, Canada.
How long we keep it
| Information | Kept |
|---|---|
| Account and content | Until you delete them or your account |
| Managed databases and file storage | Until you delete the instance. We do not keep backups of managed data. |
| Assets over the Base plan limits | Frozen; deleted after 90 days if still over the limits, after email warnings at 30, 7 and 1 day |
| Security records (sign-ins, permissions, account deletion) | Kept after account deletion, as long as needed for security and legal obligations |
| Technical logs | 30 days (tunnel connections: 3 days) |
| Expired or revoked access tokens | 30 days |
| Service backups (not including managed data) | 14 days |
| Website measurements (Insights) | 13 months |
Deleting your account
In the Console: Settings → Profile → Delete account. This deletes your projects, data instances, tunnels and devices, your tokens and your account. A record that the account was deleted is kept for security.
How we protect it
Connections are encrypted in transit. Access tokens are stored only as one-way hashes, and database credentials are encrypted. Access to production systems is limited to the people who operate the service. No system is perfectly secure: if a confidentiality incident presents a risk of serious injury, we will notify you and the Commission d'accès à l'information as the law requires.
Your rights
You can ask to access your personal information, have it corrected, have it deleted or de-indexed, receive it in a structured, commonly used technological format (portability), and withdraw your consent. Write to [email protected]; we answer within 30 days.
If you are not satisfied with our answer, you can file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or, outside Québec, the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you live in the European Union or the United Kingdom, you also have the rights given by the GDPR and can contact your local authority.
Children
Our services are not intended for children under 14, and we do not knowingly collect their personal information.
Changes
We will post any change on this page with its effective date, and notify FullStacked Cloud users by email of significant changes.
Contact
Les Services FullStacked · [to complete: address] · [email protected]