Privacy
We don't sell your data.
Where it runs
Our servers run at Hetzner, not at the big tech clouds. During this early phase, Hostlo runs behind Cloudflare: the Hostlo pages and the sites we host are delivered through Cloudflare's network, which caches pages close to visitors. Cloudflare therefore handles visitors' requests, including their IP address.
What we store
- Your email address. There is no password: you log in with a code we email you.
- For an hour after you ask for a login code, a scrambled form of your IP address, to stop abuse. It cannot be turned back into the address.
- The files you publish, and the history of every change so you can roll back.
- Which apps you connected to your account, and hashed copies of their access tokens.
The Hostlo login and connection pages set no cookies. Visits to this website, hostlo.ai, are counted the same way as visits to your site (below): totals only, no cookies, no tracking script, no IP address kept.
If you connect GitHub
Hostlo reads only the repositories you choose on GitHub, and only to publish them: it never writes to them. We keep your GitHub username and the list of repositories you gave us access to, and store only the files of the folder that becomes your site. We keep no GitHub password or token: each time a push arrives we ask GitHub for a key that can read that one repository, and it expires within the hour. Remove the HostloAI app on GitHub and the access ends at once.
People who visit your site
Site owners get simple visitor statistics: page views, unique visitors per day, top pages, referring sites and which of our locations served them. They are counted on our own servers, without cookies or tracking scripts. We don't store visitors' IP addresses. To tell visitors apart within one day, we use an anonymous code made from the address and browser type with a secret that changes every day and is never saved, so visitors can't be recognised from one day to the next. Pages served from Cloudflare's cache are not counted.
Free sites show a small “Made by chatting” badge. It is served by the site itself and collects nothing.
Contact forms
If a site has a contact form, the messages people send through it are stored so the site's owner can read them, and emailed to the owner so they can reply. The person who runs the site chooses what the form asks for and is responsible for it; for those messages Hostlo only stores and delivers them on the owner's behalf. We don't store the IP address of someone who fills in a form. Forms are for getting in touch, not for collecting passwords or payment details, and Hostlo refuses fields that look like them. An owner can delete a form and its messages at any time; we also delete stored messages automatically after about 90 days, and they are deleted with the site or the account.
Who runs Hostlo
Hostlo is operated by Innolabs Pte. Ltd., Singapore.
Contact
Questions about your data: support@hostlo.ai.
Report a site that breaks the rules: abuse@hostlo.ai.
Security issues: security@hostlo.ai.