Privacy Policy

Static files that you deploy to a public Instara site are intended to be served publicly. Visitors, search engines, caches, archives, or other third parties may be able to access, copy, index, cache, or link to public site content.

Do not place secrets, private keys, access tokens, credentials, confidential records, regulated personal information, or other information that should remain private inside a public static deployment.

Instara customers control the content and client-side functionality they publish. A customer website may use third-party scripts, forms, analytics, advertising, embedded content, APIs, or other tools that collect information directly from visitors.

The operator of that customer website is responsible for its own privacy practices, notices, consent requirements, and third-party integrations. Instara does not automatically control or receive all information collected by third-party tools embedded by a customer.

If you are a visitor to a site hosted on Instara, questions about information collected by that site's own forms, scripts, or integrations should generally be directed to the operator of that site.

Instara uses information as necessary to:

• authenticate users and maintain accounts;
• receive, validate, store, publish, and deliver static deployments;
• configure default addresses and custom domains;
• measure storage, bandwidth, visits, traffic patterns, and other plan usage;
• enforce quotas and protect the Service from abnormal or disproportionate resource consumption;
• provide deployment history, rollback, and related account features;
• process subscriptions and determine access to paid features;
• detect fraud, phishing, malware, abuse, attacks, and security incidents;
• enforce rate limits, Terms of Service, and technical restrictions;
• diagnose errors and maintain reliability; and
• comply with applicable legal obligations and valid legal requests.

Instara may use cookies, local storage, or similar browser storage when necessary for authentication, session security, preferences, and operation of the Service.

For example, the public website may store your light or dark theme preference in local storage. Authentication systems may use cookies or similar mechanisms to keep you signed in securely.

If Instara introduces non-essential analytics or advertising technologies in the future, this policy will be updated as appropriate and any consent required by applicable law will be requested.

Instara does not sell personal information for money.

Information may be shared with service providers that perform functions necessary to run Instara, such as authentication, payment processing, hosting infrastructure, storage, networking, security, monitoring, or customer support. For paid transactions, Lemon Squeezy acts as the Merchant of Record and processes payment, tax, fraud-prevention, refund, dispute, and chargeback information under its own applicable terms and privacy practices. Other providers may process information for the purpose of providing their services to Instara, subject to their applicable agreements and policies.

Information may also be disclosed when reasonably necessary to comply with law, respond to valid legal process, protect users or the public from harm, investigate abuse, enforce Instara's terms, or protect the rights, security, reliability, or financial integrity of the Service.

If Instara is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or transfer of all or part of the Service, information may be transferred as part of that transaction subject to applicable law.

When you authenticate through an external provider such as Google or GitHub, that provider controls the authentication process and may process information under its own privacy policy.

Instara seeks to use only the account information and permissions needed to authenticate you and operate your account. Instara does not assume access to unrelated provider data merely because you use OAuth to sign in.

Different categories of information are retained for different periods based on the purpose for which they are processed.

Sites, deployments, and deployment history may be retained according to the limits and retention rules of your plan. Old deployments may be removed when those limits are reached, when capacity or abuse controls require removal, or when you delete them.

Security, billing, fraud-prevention, abuse, and operational records may be retained for a reasonable period where necessary for dispute resolution, accounting, chargeback handling, security investigations, legal compliance, or enforcement of the Terms of Service.

Backups may retain deleted information temporarily until those backups rotate out of normal retention cycles.

Where deletion controls are available, you may delete deployments, sites, or your account through the Service. Deletion generally removes the relevant content from active use, subject to temporary backup retention, fraud-prevention needs, payment disputes, legal obligations, or unresolved security matters.

Deleting a deployment may make that version unavailable for rollback. Deleting a site or account may remove associated files, domains, deployment history, and configuration.

Instara uses technical and organizational safeguards intended to protect accounts, deployments, and operational data. These may include authentication controls, HTTPS, upload validation, domain verification, rate limits, access controls, abuse controls, and security monitoring.

No online service can guarantee absolute security. You should protect your authentication accounts, avoid uploading secrets or confidential material to public sites, maintain independent backups, and report suspected compromise promptly.

Instara and its service providers may process or store information in more than one country. When required by applicable law, appropriate safeguards will be used for transfers of personal information across jurisdictions.

Depending on where you live, you may have rights relating to your personal information, including rights to request access, correction, deletion, restriction, portability, or objection to certain processing.

Some rights are subject to legal exceptions, identity verification, security requirements, fraud-prevention needs, and retention obligations. Requests may be submitted to support@instara.app.

Instara is not intended to be used by a person who is not legally permitted to create an account or enter into the applicable agreement in their jurisdiction. If Instara learns that personal information was collected in violation of applicable child-privacy law, appropriate steps will be taken to delete or otherwise address it.

Where applicable privacy law requires a legal basis for processing, Instara may rely on performance of a contract, legitimate interests in operating, securing, preventing abuse, protecting the financial integrity of the Service, compliance with legal obligations, or consent where consent is the appropriate basis.

This Privacy Policy may be updated as the Service, service providers, legal requirements, or data practices change. The current version will show the date it was last updated.

If a change materially affects how personal information is handled, Instara may provide additional notice through the Service where appropriate.

Privacy questions and requests may be sent to support@instara.app.