Privacy Policy

Last Revised: September 27, 2026

This Privacy Policy describes how Litehost.io ("Litehost", "we", "us", or "our") collects, uses, and shares your information when you use our website and services at litehost.io (the "Services").

If you have questions or concerns, please contact us at [email protected].

Summary

Table of Contents

1. What Information Do We Collect?
2. How Do We Process Your Information?
3. Legal Bases for Processing
4. When and With Whom Do We Share Your Information?
5. Third-Party Services and Websites
6. Cookies and Tracking Technologies
7. Authentication and Social Login
8. Visitor Analytics on Hosted Pages
9. How Long Do We Keep Your Information?
10. How Do We Keep Your Information Safe?
11. Do We Collect Information from Minors?
12. Your Privacy Rights
13. Do-Not-Track Signals
14. California Residents (CCPA)
15. Virginia Residents (CDPA)
16. International Data Transfers
17. Updates to This Policy
18. Contact Us

1. What Information Do We Collect?

Information You Provide

When you create an account or use our Services, we may collect:

• Identity and contact data: name and email address, provided during account registration via our authentication provider (Clerk).
• Billing and payment data: subscription plan, billing cycle, and payment method details. All payment transactions are processed by Polar (polar.sh/legal/privacy). Litehost does not store raw card numbers or payment credentials.
• Content and files: files you upload to the platform, and project configurations, URLs, and settings you create.
• Support communications: information you provide when contacting us for help.

We do not collect sensitive personal information (such as health data, biometrics, or government IDs).

Information Collected Automatically

When you visit or use the Services, we automatically collect:

• Log and usage data: IP address, browser type and version, operating system, device information, pages visited, features used, and timestamps.
• Referral data: the URL you came from before landing on our site.
• Location data: approximate geographic location inferred from your IP address (country and region level).
• Cookies and similar technologies: session tokens and preference data (see Section 6).

2. How Do We Process Your Information?

We process your information to:

• Provide the Services: host your files, generate share links, serve your hosted projects, manage your account and subscription.
• Authentication: verify your identity and maintain secure login sessions via Clerk.
• Billing and subscription management: process payments, apply plan limits, manage upgrades and downgrades via Polar.
• Analytics: aggregate usage data to understand how the platform is used and improve it.
• Communications: send transactional emails (receipts, plan change confirmations, security alerts) and, with your consent, product updates or announcements.
• Security and fraud prevention: detect and prevent abuse, unauthorized access, and violations of our Terms of Service.
• Legal compliance: respond to lawful requests from courts or regulatory authorities.

3. Legal Bases for Processing

For users in the EU, UK, and EEA (GDPR):

We rely on the following legal bases:

• Contract performance: processing necessary to provide the Services you signed up for (hosting, billing, account management).
• Legitimate interests: improving platform security, preventing abuse, and analyzing aggregate usage patterns, where these interests do not override your rights.
• Consent: for optional marketing communications, which you can withdraw at any time.
• Legal obligation: where required to comply with applicable laws or lawful government requests.

For users in Canada:

We rely on express or implied consent, as appropriate under PIPEDA and applicable provincial laws. You may withdraw consent at any time by contacting us.

4. When and With Whom Do We Share Your Information?

We do not sell, rent, or trade your personal information. We share data only in these limited circumstances:

• Service providers: We engage trusted third-party providers to help operate the platform. These include:

  • Clerk: authentication and identity management (clerk.com/privacy)
  • Polar: subscription billing and payment processing (polar.sh/legal/privacy)
  • Cloudflare: infrastructure, CDN, and DDoS protection (cloudflare.com/privacypolicy)
  • Cloud storage and server infrastructure providers for file hosting

  These providers access your data only to perform services on our behalf and are contractually bound to protect it.

• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

• Legal requirements: We may disclose your information if required to do so by law, court order, or government authority, or to protect the rights, safety, or property of Litehost, our users, or the public.

We do not share personal data with any third party for their own marketing or advertising purposes.

5. Third-Party Services and Websites

Our platform may include links to third-party websites or integrations. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party service you interact with through or alongside Litehost.

Product analytics and session replay (PostHog)

We use PostHog (posthog.com/privacy) to understand how Litehost is used and to diagnose problems. PostHog receives:

• Usage events: pages viewed, buttons and pricing dialogs used, uploads started, and subscription or payment events that our own servers report (plan tier, billing interval, amount and currency).
• Session replays: recordings of your interactions on litehost.io, including the dashboard and the upload flow, so we can reproduce bugs and improve the product.

What recordings never include:

• Anything you type into a text field is masked.
• Your uploaded work (including file previews and viewers, file names, archive paths, and the visitor email addresses you collect) is excluded from recordings. The content of your projects is never recorded.
• Payment card details: payments happen entirely inside Polar's own checkout, which we never record.

Analytics requests are sent to Litehost's own endpoint (api.litehost.io/ingest) and forwarded by our API to PostHog Cloud in the United States, which stores the data on our behalf. PostHog keeps an identifier in your browser's local storage and in a cookie to recognise returning visitors.

We do not sell this data, we do not use it for advertising, and we do not follow you across other websites. You can stop it by clearing site data or blocking cookies and local storage for litehost.io. You can also email [email protected] to have analytics data linked to your account deleted.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain your authenticated session.
• Remember your preferences.
• Protect against cross-site request forgery.
• Collect anonymized usage analytics to improve the platform.

Types of cookies we use:

You can control cookie behavior through your browser settings. Disabling essential cookies may impair core functionality. We do not use cookies for advertising or cross-site tracking. See Section 5 for what our analytics provider records.

7. Authentication and Social Login

Account authentication is handled by Clerk. When you register or sign in, Clerk may collect your email address, name, and profile information. If you sign in using a third-party provider (such as Google), we receive a limited set of profile data (typically your name and email) from that provider.

We use this information solely to authenticate you and personalize your Litehost experience. We do not control the data practices of third-party authentication providers. Please review their privacy policies directly.

8. Visitor Analytics on Hosted Pages

Litehost provides analytics features that collect data about visitors to your hosted projects. This includes:

• Approximate geographic location (country/region, inferred from IP)
• Browser type and version
• Device type and operating system
• Referral source (the URL that directed the visitor to your page)
• Page views, session duration, and interaction events

Your responsibility as a Litehost user: If you use our analytics features, you are acting as a data controller with respect to your visitors' data. You are responsible for:

• Complying with applicable privacy laws in your jurisdiction (including GDPR, CCPA, etc.).
• Providing appropriate privacy notices and obtaining any required consents from your own visitors.
• Ensuring your use of visitor data complies with our Terms of Service.

Litehost processes visitor data on your behalf as a data processor. Visitor IP addresses are anonymized before storage. We do not sell or share visitor analytics data with any third party.

9. How Long Do We Keep Your Information?

We retain your personal information for as long as your account is active. Specific retention periods:

• Account data: retained for the duration of your account. Deleted within 90 days of account closure, except where required by law.
• Billing records: retained for a minimum of 7 years as required for financial/tax compliance.
• Uploaded files and project data: deleted upon your request or within 30 days of account termination.
• Log and usage data: retained for up to 12 months for security and diagnostics purposes.
• Analytics data: retained for up to 24 months on active accounts; aggregated or deleted upon account closure.

When we no longer have a legitimate need to retain your information, we securely delete or anonymize it.

10. How Do We Keep Your Information Safe?

We implement technical and organizational safeguards to protect your data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Access controls limiting data access to authorized personnel.
• Infrastructure hosted behind Cloudflare's security layer.
• Regular security reviews.

No system is completely immune to breach. While we do our best to protect your data, we cannot guarantee absolute security. In the event of a breach affecting your rights or freedoms, we will notify you as required by applicable law.

11. Do We Collect Information from Minors?

No. Litehost is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will take prompt steps to delete it.

12. Your Privacy Rights

Depending on where you are located, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit how we process your data.
• Portability: Request a machine-readable export of your data.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or within the timeframe required by your applicable law).

EEA/UK users: If you believe we are unlawfully processing your data, you have the right to lodge a complaint with your national data protection authority (e.g., the ICO in the UK).

Marketing opt-out: You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any email or by contacting us directly. We will continue to send essential transactional emails related to your account.

Account deletion: To delete your account, contact us at [email protected]. We will deactivate your account and begin the deletion process within 30 days, subject to legal retention obligations.

13. Do-Not-Track Signals

Some browsers transmit Do-Not-Track (DNT) signals. We do not currently alter our data collection practices in response to DNT signals, as no universal standard for interpreting them has been adopted. If a recognized standard is established, we will update this policy accordingly.

14. California Residents (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

Categories of personal information collected in the past 12 months:

Your CCPA rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, used, disclosed, or sold.
• Right to Delete: Request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt-Out of Sale: We do not sell personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA request, email [email protected] with the subject "CCPA Privacy Request" and include your email address and the nature of your request. We will verify your identity before processing the request.

California minors: If you are under 18 and have a registered account, you may request removal of any content you publicly posted by contacting us at [email protected].

15. Virginia Residents (CDPA)

If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act (CDPA):

• Right to access your personal data.
• Right to correct inaccuracies.
• Right to delete your personal data.
• Right to obtain a portable copy of your data.
• Right to opt out of targeted advertising, sale of personal data, and profiling.

Litehost does not sell personal data and does not use personal data for targeted advertising.

To submit a CDPA request, contact us at [email protected]. We will respond within 45 days, with one possible 45-day extension. If we deny your request, you may appeal by emailing us with "CDPA Appeal" in the subject line. If your appeal is denied, you may contact the Virginia Attorney General.

16. International Data Transfers

Litehost operates globally. Your information may be transferred to and processed in countries other than your own, including countries that may have different data protection standards.

For transfers from the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions. By using the Services, you consent to such transfers in accordance with this policy.

17. Updates to This Policy

We may update this Privacy Policy from time to time. The "Last Revised" date at the top will reflect the most recent update. For material changes, we will notify you by email or by displaying a prominent notice on the platform. We encourage you to review this policy periodically.

18. Contact Us

If you have any questions, requests, or complaints about this Privacy Policy or how we handle your data:

Email: [email protected]
Website: litehost.io

We aim to respond to all privacy inquiries within 30 days.