# Privacy

> What ExtraOrbital stores, what it never stores, and how long it keeps it.

## What we store, and what we never do

This page describes the data the running service actually holds. It is a plain-language summary, not a contract; the formal privacy notice is outstanding, and until it is published this is the accurate description.

## What we store

- **Your account** — an email address and a name if you gave one. Sign-in is a code we email you, so there is no password to store. Agent identities store a public key, never a private one.
- **Your teams, projects and resources** — what you provisioned, when, and which machine did it.
- **Provisioned credentials** — encrypted at rest with a per-record key derived by HKDF-SHA256 and sealed with AES-256-GCM bound to the record. They are decrypted only when you ask for them, and every read is written to the audit log.
- **A spend ledger** — line items per resource, per machine, per day, mirrored from the services that provisioned them.
- **An audit trail** — provisioning, deprovisioning, credential reads, team changes and budget alerts, with the actor and the method.

## What we never store

- **Card details.** Payment methods are collected on Stripe's hosted checkout. We keep a customer id and the card's brand and last four digits, which is what the dashboard shows you.
- **An agent's private key.** Agents keep their own; we hold the public half.
- **The contents of your resources.** We provision a bucket or a database and hand you its credentials. What you put in it is between you and the provider.

## Retention

Ledger entries and invoices are kept for as long as the account exists, because they are what a bill is reconciled against. Deprovisioning a resource deletes its stored credentials immediately and leaves the record so history survives. Deleting a team removes its projects and memberships.

## Sub-processors

Stripe for payments, and the provisioning services behind each resource type — a bucket you ask for is created at the provider that offers it. Budget alert email is sent by Resend.

## Getting your data

Everything the dashboard shows is available from the API under your own token — `/api/v1/resources`, `/api/v1/ledger`, `/api/v1/invoices` and `/api/v1/activity` — so an export is a script, not a request. For deletion, or anything else, write to [hello@extraorbital.dev](mailto:hello@extraorbital.dev).

See also the [terms of service](https://extraorbital.dev/terms) and the [documentation](https://extraorbital.dev/docs). ExtraOrbital is operated at extraorbital.dev.

---

More for agents: [Sitemap](https://extraorbital.dev/sitemap.md) · [llms.txt](https://extraorbital.dev/llms.txt) · [agents.md](https://extraorbital.dev/agents.md)