Privacy Policy

kvbox is made by LOGZAI SRL, a limited liability company registered in Romania (“we”, “us”). We are the data controller for the personal data described in this policy.

• Registered office: Fagarasi 19, Dumbravita, Romania
• Tax identification number (CUI): 53038901
• Trade Register number: J2025094020008
• EUID: ROONRC.J2025094020008

You can reach us about anything on this page at hello@kvbox.sh.

To use the hosted service you need an account, and an account means we hold a small amount of information about you:

• Your email address, name and username. The username names your boxes and appears in the SSH certificates we issue you, so members of an organisation you belong to can see it.
• Your password, hashed. We store a salted scrypt hash, never the password itself.
• Your login tokens, hashed. The token the CLI or the web app holds is stored on our side only as a hash, with when it was last used. Logging out removes it.
• Your SSH public keys, and the short-lived SSH certificates we sign so you can connect to your boxes. A certificate lives one day.
• Your organisations and roles: which ones you belong to and what you may do in each.

You create your own account on this website with an email address and a password. A new account is inactive until we activate it; one that is never activated and stays idle is deleted after 30 days. We send no email when you sign up.

The substance of kvbox is your boxes: each one’s disk, and when it is paused, hibernated or snapshotted, its memory. Whatever you, a script or an AI agent put in a box is in there: code, files, databases, and possibly secrets or personal data.

We do not look inside your boxes. We store them, start and stop them, copy them when you fork or snapshot one, and delete them when you ask. For any personal data about other people inside a box, you are the controller and we are your processor: we hold it and run it on your instruction, and we do nothing else with it.

Around each box we keep what we need to run it: its name, owner, size, state, the host it runs on, its address, the ports and HTTPS names you opened, and the authorised SSH keys we place in it.

When you publish a box at an HTTPS name under kvbox.app, visitors reach it through our edge, which passes their requests to your box and the answers back. We do not store the content of those requests. The visitor’s IP address and the request reach your box, and what your box does with them is yours to account for.

Our servers keep ordinary request logs, including IP addresses, for a short period in order to run the service and protect it from abuse. We do not use those logs to build any profile of you.

To charge for the service we record a ledger of what your boxes use: when each one starts and stops, how much memory it was given, and which user created it. From that we compute what you spent, and we keep a record of your credit top-ups. This is billing data, and we keep it as long as the law requires us to keep accounting records.

The kvbox control plane, which holds your account, the box index and the usage ledger in a PostgreSQL database, runs on servers we operate at Hetzner Online GmbH in Finland. Your boxes run on hosts we operate in the European Union, so your data is not transferred abroad simply by being stored. Traffic between the CLI, the control plane and the hosts is encrypted in transit. Hetzner acts as our processor under its own privacy policy.

We back up the control plane’s database, so account data deleted from the live service can persist in a backup for a short while before ageing out. We do not back up the contents of your boxes.

Today, only Hetzner as our hosting provider. The control plane’s logs go to LogzAI, which is our own company’s log service, not a third party. There is no analytics, advertising or error-tracking provider, and no payment processor yet. When card payments arrive, the payment provider will be named here before it sees anything.

This website sets no cookies and loads no analytics or tracking script. It has no login and no session to remember.

The web app needs to remember that you are signed in. It keeps your login token and your basic account details in your browser’s local storage rather than in a cookie. That is strictly necessary for the app to work, it is not analytics, and it is shared with no one. Signing out clears it. The kvbox CLI keeps its token in a file on your own machine, readable only by you.

If you write to us (a bug report, a feature suggestion, a question) we hold that message and your email address for as long as needed to deal with it and to keep a record of the decision. We use it only to reply and to improve kvbox. We do not add you to any marketing list.

A box stays until you remove it, and removing it deletes its disk, memory and every file it had on our host. A snapshot stays until you remove it. Closing your account removes your boxes, snapshots, keys and account record. Ask us and we will do it; you do not need a reason.

Billing records are kept for as long as Romanian accounting law requires. Backups of the control plane age out on their own cycle, and we keep the minimum record needed to show that a request was made and honoured.

• We do not sell or rent your personal data.
• We do not look inside your boxes or train machine learning models on their contents.
• We do not read your files or your traffic for our own purposes, mine them for product ideas, or show them to anyone you have not shared them with.
• We do not serve advertising, run ad networks, or use tracking of any kind on this website.
• We build no profile of you as an individual.

We are established in Romania, so the EU GDPR applies to what we do, and equivalent rights apply if you are in the UK. You have the right to access your personal data, correct it, have it deleted, restrict or object to our use of it, and receive a copy of it in a portable form. Write to hello@kvbox.sh and we will respond within one month.

Our lawful basis is the contract between us for everything needed to provide the service (your account, your boxes, billing), a legal obligation for the accounting records we must keep, and our legitimate interest in keeping the service secure and available for the rest.

If you are unhappy with how we have handled your data, you can complain to our supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), Romania’s national data protection authority: dataprotection.ro. If you live elsewhere in the EU, you may also complain to your own national authority.

kvbox is a professional developer tool and is not directed at children. We do not knowingly collect personal data from children, and accounts are meant for adults.

Romania has not lowered the age set by Article 8 of the GDPR, so where consent is the basis for anything we do, it is only valid from the age of 16. If you believe a child has given us personal data, write to hello@kvbox.sh and we will delete it.

kvbox is in active development, and this policy will change as the product does, particularly when we add a payment provider or any other service that touches your data. We will update the date at the top of this page whenever it changes, and tell account holders about anything significant.

Questions about this policy, or about privacy in kvbox generally: hello@kvbox.sh.