Privacy Policy

Last updated: 2026-04-17

This policy explains what smoldb collects and how we use it.

What we collect

  • Account info from Google sign-in: email and name.
  • Content you create: tables, rows, files, and SQL queries you run.
  • Billing info: handled entirely by Stripe. We only store a Stripe customer ID to match subscription events to your account.
  • Request logs: in-memory counters for rate limiting. Not persisted.
  • Error reports: stored only when you click "Send error report" on an error card.

How we use it

We use your info to run the service: show you your data, enforce plan limits, bill you, and fix bugs. We do not sell your data. We do not use your content to train AI models.

Who we share with

We share limited data only with service providers required to operate smoldb:

  • Stripe for payments
  • Cloudflare R2 for encrypted database backups
  • Google for OAuth sign-in
  • Fly.io for hosting

Each provider is bound to handle your data on our behalf. We do not sell or rent your data to anyone. We may disclose data if compelled by law or a valid legal process.

Where your data lives

  • The app runs on Fly.io in the US (iad region)
  • Metadata backups in Cloudflare R2
  • Card data at Stripe (never on our servers)

Security

  • HTTPS for all traffic
  • API keys stored hashed with scrypt; shown to you once at creation
  • Encrypted Fly volumes at rest
  • Signed webhooks from Stripe verified on every event

Your rights

  • Access: see everything via the dashboard or API
  • Export: run any SQL via the console or use the SDK
  • Delete: delete any project from its Settings tab (removes the SQLite database and all file blobs). For full account deletion, submit a request via the report page.
  • Correct: edit your account data in your Google account

Cookies

We use one cookie: a secure session cookie that keeps you signed in. No analytics, no ad tracking, no third-party cookies.

Children

smoldb is not intended for children under 13. We do not knowingly collect data from them. If you believe a child has signed up, submit a request via the report page and we will delete the account.

Contact

Submit any privacy question or request via the report page.