Privacy Policy
Last updated: 6 May 2026 · Effective immediately
Instadash is operated by Codextech Pty Ltd ("we", "us", "our"), a company registered in Victoria, Australia. This policy explains what data we collect, how we use it, and your rights.
1. Data we collect
Account data
When you sign in via GitHub OAuth or magic link, we receive your email address and, where provided by GitHub, your name and profile image. We store this to identify your account and communicate with you.
Grid data
Any JSON, CSV, NDJSON, or log files you push to Instadash are stored on your behalf in Cloudflare R2 object storage. You own this data. We process it only to provide the service (schema inference, API endpoints, version history).
Usage data
We log API requests, push events, and page views to operate and improve the service. Logs include timestamps, endpoint paths, response codes, and anonymised IP addresses. We do not build advertising profiles from this data.
Billing data
Paid plan payments are handled by Stripe. We never see or store your full card number. We receive a Stripe customer ID and subscription status so we can provision your plan.
Cookies and local storage
We use a single session cookie issued by our authentication system (better-auth) to keep you signed in. No third-party tracking cookies. No analytics pixels.
2. How we use your data
- Authenticate you and maintain your session
- Store, serve, and version your grid data
- Process payments and manage your subscription
- Send transactional emails (magic-link sign-in, billing receipts)
- Debug incidents and investigate abuse
- Improve the product using aggregated, anonymised usage signals
We do not sell your data. We do not use your data for advertising.
3. Data storage and transfers
Your data is stored on Cloudflare's global infrastructure (R2, D1, Workers KV). Cloudflare's primary processing regions include the United States and European Union. By using Instadash you consent to your data being processed in these regions.
Platform-tier customers can bring their own Cloudflare account and R2 bucket to keep data within a specific region.
4. Third parties
We share data with the following third parties only as necessary to provide the service:
- Cloudflare — infrastructure, storage, CDN
- Stripe — payment processing
- GitHub — OAuth sign-in (only if you choose GitHub login)
We do not share your data with any other third parties without your explicit consent, except where required by law.
5. Data retention
Grid data is retained for as long as your account is active. On account deletion, your grids and associated data are deleted within 30 days. Version history snapshots are deleted on the same schedule.
Billing records are retained for 7 years as required by Australian tax law.
Server logs are retained for 90 days and then permanently deleted.
6. Your rights
Under the Australian Privacy Act 1988 and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your account and associated data
- Export your grid data at any time via the CLI (
instadash export) - Object to or restrict certain processing
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) or your local data protection authority
To exercise any of these rights, email us at privacy@instadash.io. We will respond within 30 days.
7. Security
All data in transit is encrypted via TLS. Grid data at rest is encrypted by Cloudflare R2. Session tokens are stored in httpOnly, SameSite cookies. API keys are stored as hashed values — we cannot recover a key once issued.
If you discover a security vulnerability, please report it to security@instadash.io before public disclosure.
8. Children
Instadash is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@instadash.io and we will delete it promptly.
9. Changes to this policy
We may update this policy from time to time. We will notify you by email at least 14 days before material changes take effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.
10. Contact
Questions or requests about this policy:
Codextech Pty Ltd
Melbourne, Victoria, Australia
privacy@instadash.io