Legal
Privacy notice
Last changed 2026-11-07.
This notice covers the store at https://sundo.gs ("the store", "we"): your account, purchases, downloads and AI agents. It does not cover the websites where you install our apps: those sites never send us data (see "What we never get" below).
Who is responsible: SocialKreature LLC dba Sundogs, 2103 Harrison Ave NW, Ste 2 PMB 1135, Olympia, WA 98502, United States. Contact for anything in this notice, including requests about your data: support@sundo.gs.
What we collect, and why
| What | Where it comes from | Why | Legal basis (EU/UK) |
|---|---|---|---|
| Email address; a display name (the email itself, or the name your sign-in provider sends) and a profile picture address if the provider sends one; which sign-in methods you linked | You, or GitHub, Google or Cloudflare when you sign in with them | Your account, sign-in links, order emails | Contract |
| Sign-in sessions: a session record with your IP address and browser user agent | Your browser | Keeping you signed in, security | Contract; legitimate interests (security) |
| API keys (stored as a hash plus the first 8 characters and the name you gave it) and AI agents you approved (the agent's name and address, the permissions) | You | Letting your agents act for you | Contract |
| Licenses: app, license type, site domain, update end date, which license version you accepted and when | Your claims and purchases | Providing what you bought, enforcing the license | Contract |
| Orders: items, prices, discount and code, currency, amount paid and refunded, status, dispute status, the terms versions you ticked and when, Stripe reference numbers | Checkout and Stripe | Selling, refunds, tax and accounting records | Contract; legal obligation |
| Sites and downloads: the site domains you download for, which apps and versions, a client label if you add one, dates, the file checksum and the buyer code marked in each download; license moves between domains | Your downloads and update checks | Delivering updates, the per-site license, your Sites page | Contract; legitimate interests (tracing leaked copies) |
| Rate-limit counters keyed by your IP address, account or email address | Requests to the store | Stopping abuse (sign-in floods, code guessing) | Legitimate interests (security) |
| Waitlist signups ("tell me when my host is supported"): your email, a first name if you give one, which list, the page and country you signed up from, and a one-way hash of your IP address (never the address itself) | You, on the store's public pages | Emailing you when that support is ready; the hash stops people counting their own referrals | Consent |
| Reviews you send us: your name, an optional role or company, the rating and text, and your email (never shown) | You, through the review form | Showing reviews on the store once we approve them, and contacting you about yours | Consent |
| Cookie choices: a random id, what you allowed, your country and when | Your choice on the cookie banner | Proving the choice you made | Legal obligation |
Measuring the store and advertising
- Cloudflare Web Analytics counts page views, the page and referring site, country, and browser and device type. It sets no cookie and doesn't track you across sites. Legal basis: legitimate interests (knowing which pages people use).
- Our own analytics (our Analytics app, running in our own Cloudflare account) records visits and actions such as a form sent, by page, referring site or campaign, country and device type. Where consent is needed, a visitor cookie (
_sv, one year) that lets us count unique visitors is set only after you allow analytics. We don't store IP addresses or full browser details. Legal basis: consent where the law asks for it, otherwise legitimate interests. - Google Analytics (Google) measures how visitors use the store's public pages. It sets its own cookies (
_gaand_ga_<id>, 2 years) and receives your IP address, browser details and the pages you visit, and Google also uses that data under its own privacy policy. Legal basis: consent where the law asks for it (EU, UK, EEA, Switzerland); elsewhere legitimate interests.
Apart from Cloudflare Web Analytics, these run only on the store's public pages (home, apps, guides), never on sign-in, account, checkout, download or admin pages. In the EU, UK, EEA and Switzerland we ask before any analytics or advertising cookie is set (the banner at the bottom of the page), and you can change your choice any time from the Cookie settings link at the bottom of every page.
We don't use advertising tools, and we don't sell or share your personal information for advertising.
What we never get
- Data from your websites. The apps run in your own Cloudflare account and keep their data there. Your site's server code never contacts us.
- Update notices: while you view your site's admin, your browser fetches our public list of latest versions. Like any web request it carries your IP address and the admin page's address; we don't log or store them. You can turn it off with
SITE_APPS_UPDATE_FEED=off. - If you run our apps, you are the controller of your visitors' data and we are not your processor: see section 8 of the terms of sale.
Cookies and browser storage
- A sign-in cookie (strictly necessary; HttpOnly, secure; it expires 14 days after you last used the store, or when you sign out). During a sign-in with GitHub, Google or Cloudflare, short-lived cookies hold the sign-in state.
- The account pages remember your light or dark theme choice in your browser's local storage. It never leaves your browser.
- The sign-in form may use Cloudflare Turnstile to check you're not a bot (the Cloudflare privacy policy).
- Your cookie choice (
_site_consent, up to a year) and, if you opt out of sharing, an opt-out cookie (_site_optout), so we remember them. - Analytics and advertising cookies, only as described in "Measuring the store and advertising" above.
Who processes data for us
- Cloudflare hosts the store (Workers, D1 database, R2 storage), sends our emails (Cloudflare Email Service: sign-in links and order confirmations) and runs Turnstile. Cloudflare acts as our processor under its data processing terms (privacy policy).
- Stripe (payments). At checkout you pay on Stripe's page, sold through Link, Stripe's checkout service, which is the merchant of record. Stripe collects your card or other payment details, billing address and email, works out tax, and keeps the payment records. For that it is an independent controller, under Stripe's privacy policy and Link's. We never see your full card number. Stripe tells us the payment's status, amount, currency, tax and its own reference numbers (customer, payment, subscription, invoice), and we send Stripe your email and what you are buying. You can ask Link to delete your payment data; Stripe then cancels any subscriptions sold through it.
- Cloudflare also runs Cloudflare Web Analytics for us (see above).
- The tools listed under "Measuring the store and advertising" (Google). They receive data from your browser directly and use it under their own privacy policies, linked above.
- GitHub, Google or Cloudflare, only if you choose to sign in with them. We ask only for your email address and basic profile, and we don't keep their access tokens.
These providers work in many countries, including the United States. They use their own legal safeguards for international transfers (such as the EU Standard Contractual Clauses).
How long we keep it
| Data | Kept |
|---|---|
| Account, licenses, API keys, approved agents, sites, download history | Until you delete your account |
| Sign-in sessions (with IP address and user agent) | Until you sign out or the session expires (14 days after you last used the store); expired rows are cleared regularly |
| Sign-in links | 5 minutes, and they work once |
| Rate-limit counters (IP address, account or email) | About a day after the last request |
| Waitlist signups | Until you ask to be removed, or we close the list |
| Reviews | Until you ask us to remove yours, or we delete it |
| Cookie choice records | 2 years |
| Our own analytics: visit and conversion records | About 13 months (400 days); daily totals without any visitor in them are kept |
| Google Analytics | 14 months (the Google Analytics data retention setting we use) |
| Orders, and the license records they created | After you delete your account they stay for tax, accounting and refund records, for as long as the law requires (often 6 to 10 years). They then carry no email address, but they still hold Stripe's reference numbers and the site domains in the order, so they can be matched to Stripe's payment records |
| Error logs | A few days (the Cloudflare log retention); they don't contain your IP address |
| Stripe's payment records | Kept by Stripe under its own policy |
Your rights
Wherever you live, you can:
- See and export your data: Account, Settings, Export my data downloads one file with your account, licenses, orders, sites, downloads, API key names and approved agents. For anything not in it (such as your session records), write to us.
- Delete your account: Account, Settings, Delete my account. Your sign-in, sessions, API keys, approved agents, sites list and download history are deleted at once; your licenses end; order records stay as described above. Cancel any running subscription first (the page tells you).
- Correct your data: write to us (for example to change your email address).
- Write to us to object to or restrict a use of your data, or with any question.
EU and UK: you have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR / UK GDPR, and you can complain to your data protection authority. California: you have the right to know, delete and correct your personal information and not to be discriminated against for using these rights. We don't sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information beyond what is needed to provide the store. The categories we collect are listed in the table above: identifiers (email, IP address), commercial information (orders) and internet activity (downloads and update checks).
We answer requests within one month. We may need to confirm the request comes from you, for example by an email to your account address.
Children
The store is for people building websites and is not directed at children under 16.
Changes
If we change this notice, we update the date at the top and, for changes that matter, tell account holders by email or on the account page.
Other pages: Terms of sale · Privacy notice · Refund policy · License for paid apps · Free license