2.1 Developers

• Account information: name, email address, and profile image supplied by GitHub or Google when you authenticate. Developer sign-in (`npx deepspace login` and the developer dashboard) is GitHub or Google only; we do not expose email-and-password sign-in to developers.
• Billing information: handled by Stripe, our payment processor. We do not see or store payment card numbers. We store an opaque Stripe customer identifier and your subscription, credit balance, and invoice history.
• Deploy metadata: names of apps you have deployed, deployment timestamps and version identifiers, the build artifacts you upload (compiled worker code and bundled static assets), Cloudflare resource bindings you have configured, custom-domain bindings, and the integrations enabled in your app's manifest.
• Application secrets: values you place in the user-managed section of your app's `.dev.vars` file are uploaded as secret bindings on deploy and stored by Cloudflare's secret-binding service so your deployed worker can read them. We do not display these values back to you and we do not use them outside of provisioning your worker.
• Usage telemetry: per-invocation operational counters (request path, HTTP method, country reported by Cloudflare's network, Cloudflare colocation, HTTP status, CPU and wall-clock time) attributed to each app you own. We use this to enforce quotas, calculate billing, surface analytics in your dashboard, and investigate operational problems. See §6.
• OAuth tokens for connected services: if you connect your DeepSpace account to a third-party service through a platform integration, the resulting OAuth access and refresh tokens are stored encrypted at rest. See §11.
• Stripe Connect details: if you opt into receiving developer payouts, Stripe collects your identity, banking, and tax information directly through Stripe Express. We store only the opaque Stripe account identifier and the status flags Stripe reports to us (for example, whether payouts are enabled).
• Custom-domain purchase evidence: if you purchase a domain through us, we capture the date, IP address, and user-agent associated with your acceptance of the registrar's terms of service. The registries we use require this as evidence for responding to chargebacks and abuse complaints.
• Managed-repository metadata: if you elect to host your app's source in a DeepSpace-managed GitHub repository, we store the repository's GitHub owner login, the repository name, the GitHub-assigned numeric repository identifier, the HTTPS URL at which it can be cloned, its visibility setting, its lifecycle status (for example, active or deleted), the link between it and your DeepSpace app, and creation and update timestamps. We do not maintain a copy of your source code, branches, or commit history outside of GitHub.
• Ad-click identifiers: if you arrive at deep.space from one of our own advertisements, the advertising network's click identifier (such as a gclid) is captured in a first-party cookie (see §8), and if you then create an account it is stored alongside your account identifier so we can attribute the signup to our advertising and report it as described in §4.

2.2 End-users of apps built on the platform

• Account information: when you authenticate with GitHub or Google, we receive the name, email address, and profile image those providers supply. Where an app exposes email-and-password sign-in (which the SDK's default sign-in card includes), we receive the email address and the password you choose; the password is stored only as a salted hash, not in clear text.
• Authentication state: a short-lived signed identity token (default five minutes) issued by our authentication service that the app you signed into presents to its own worker. Deployed apps do not set a long-lived authentication cookie of their own. See §8 for the full cookie inventory and lifetimes.
• App content: records, messages, files, collaborative-document state, and similar content you save inside an app are stored in databases that DeepSpace operates on the app developer's behalf. The developer's app code is what reads, writes, and decides who within the app can see what.
• Anonymous use: where an app allows it, you may also participate without signing in. In that case the app sees only a temporary identifier generated for the duration of your visit, and no DeepSpace account is created or persisted for you.
• Platform-level metadata: session timestamps, IP address (used to operate the network and detect abuse), user-agent, and the per-invocation request metadata described in §6.
• Cross-app shared data: the SDK exposes platform-wide stores for content that is intended to be shareable across apps — a workspace store and a cross-app conversation store. Developers are required by our Terms of Service (see Terms §4.3) to write only public-safe content to these stores and to keep personal or app-private information in their own per-app data store, where standard role-based access controls apply.
• AI assistant actions: many apps built on the SDK include an AI assistant that runs under your identity. The assistant can be configured by the developer to read records, and — by default in the SDK scaffold — to create, update, and delete records on your behalf. Those actions are bounded by your own role-based permissions inside the app, but you should treat the assistant as a tool you have asked to act on your data.
• Payment information: if you make a purchase inside an app (a subscription, a one-time product, or a tip), payment is processed by Stripe through Stripe Checkout. We do not see or store card numbers. We store the purchase amount, the app it was for, the Stripe identifiers needed to issue refunds, and tax data Stripe returns to us.
• Integration data: where a developer's app asks you to connect a third-party account (for example, Google), the OAuth grant happens between you and the third party. We store the resulting access and refresh tokens encrypted at rest and use them only to fulfill requests you or the app make on your behalf. See §5 for Google specifics.

4.1 Sub-processors used by the core platform

• Cloudflare, Inc. — Workers for Platforms, Durable Objects, R2, KV, D1, Browser Rendering, Workers Logs, Analytics Engine, Workers AI, and the Cloudflare Registrar. All DeepSpace infrastructure, every deployed app, and the data those apps store run on Cloudflare's edge network.
• Stripe, Inc. — payment processing and Stripe Connect for developer payouts.
• Resend, Inc. — transactional email delivery.
• Anthropic, PBC — Claude model APIs used by SDK-side AI features when an app routes traffic through the Anthropic proxy.
• OpenAI, L.L.C. — GPT, image, and speech model APIs used by SDK-side AI features when an app routes traffic through the OpenAI proxy.
• Cerebras Systems, Inc. — inference API offered through the Cerebras proxy.
• Google LLC — Gemini model API used by SDK-side AI features when an app routes traffic through the Gemini proxy; Google OAuth for sign-in; the Google Workspace APIs that back the Google integration described in §5. Separately, when a signup is attributable to one of our own Google Ads advertisements, we report that conversion to Google Ads: the advertising click identifier that accompanied the visit, the fact and time of the signup, a one-way SHA-256 hash of the email address, used solely so Google can match the conversion to the ad click (see §8 for the cookie involved), and an internal account identifier used only to prevent the same signup from being counted twice. This measurement reporting is the only advertising-related data flow to Google, and it concerns our own ads only. For this reporting, Google acts as an independent controller for its advertising services rather than as our processor; we treat it as measurement of our own advertising, not as "sharing" for cross-context behavioral advertising.
• GitHub, Inc. — GitHub OAuth for sign-in; private repositories created on a DeepSpace-controlled organization when a developer opts into managed repositories.
• ElevenLabs, Inc. — text-to-speech, voice synthesis, and conversational-agent APIs when an app enables voice features.
• LiveKit, Inc. — audio/video room hosting when an app enables real-time AV features. Media streams flow directly between participants and LiveKit; DeepSpace only mints access tokens.
• Porkbun LLC — domain registration for top-level domains that Cloudflare Registrar does not handle.

4.2 Per-integration third-party services

• AI model providers: Anthropic (chat completions, and a grounded web-search endpoint that Anthropic itself runs), OpenAI (chat completions, image generation, text-to-speech, and Whisper speech-to-text), Cerebras Systems (chat completions, exposed through a passthrough proxy that forwards the request to Cerebras's API as-is), and Google (Gemini chat completions and Gemini image generation).
• Voice and conversational-AI provider: ElevenLabs (text-to-speech, voice listing, and conversational agents).
• Real-time audio and video: LiveKit (room hosting; media streams flow between participants and LiveKit directly, and DeepSpace mints access tokens only).
• Web search, scraping, and extraction: SerpAPI (which backs our general web-search, scholar search, Amazon product search, and LinkedIn lookups, each grouped in our catalog under the kind of result the developer is asking for), Exa, and Firecrawl.
• News, weather, sports, and finance: NewsAPI, OpenWeatherMap, API-Sports (football, basketball, baseball, and American football), Finnhub, Alpha Vantage, the public Coinbase market-data API, and the public Polymarket markets API.
• Transactional email: Resend (we send our own platform email through Resend, and apps can send email through the email integration).
• Files and media generation: CloudConvert (file conversion), Submagic (video captioning), and Freepik (image and video generation).
• Social and messaging platforms: Slack and TikTok (each only when an app makes a call through that integration).
• Developer and content-platform metadata (read-only catalog access): GitHub (public repository, commit, pull-request, issue, contributor, and tree metadata), YouTube (video search and video metadata), and Instagram (public-post content extraction).
• Reference data: Wikipedia, NASA's public APIs, the New York City MTA public feeds, and the public Jolpica / Ergast Formula 1 API.
• Self-hosted services we operate: a LaTeX rendering service we run on Cloudflare for compiling LaTeX source to PDF.

4.3 App developers

4.4 Legal and safety

4.5 Business transfers

5.1 Scopes we request and the purpose of each

• openid, https://www.googleapis.com/auth/userinfo.profile, and https://www.googleapis.com/auth/userinfo.email — used to authenticate the user, retrieve the user's display name, profile image, and email address from Google, and associate the user's Google identity with their DeepSpace account.
• https://www.googleapis.com/auth/gmail.readonly — read-only access to the user's Gmail messages, threads, labels, and message metadata. DeepSpace uses this scope solely to display the user's email correspondence alongside the contact, deal, and account records the user has chosen to maintain inside a DeepSpace app, so that the user can review their own customer-relationship context in one place. DeepSpace does not send, draft, modify, label, move, archive, delete, or otherwise alter any message, thread, or mailbox state through this scope.
• https://www.googleapis.com/auth/calendar.events — reading, creating, and deleting events on calendars the user owns, only when the user or the app the user is using initiates the action.
• https://www.googleapis.com/auth/drive.file — limited Drive access scoped to files the user has explicitly created with, or opened with, the connected DeepSpace app.
• https://www.googleapis.com/auth/contacts.readonly — read-only access to the user's Google Contacts so the connected DeepSpace app can show contact information alongside the user's other app data.

5.2 Limited Use of Google user data

• DeepSpace uses Google user data only to provide or improve user-facing features of the DeepSpace app the user has connected their Google account to. We do not use Google user data for any unrelated purpose.
• DeepSpace does not transfer Google user data to others except (i) as necessary to provide or improve those user-facing features, (ii) to comply with applicable law, or (iii) as part of a merger, acquisition, or sale of assets with notice to users.
• DeepSpace does not use Google user data to serve advertisements, including retargeting, personalized advertising, or interest-based advertising.
• DeepSpace does not sell, rent, lease, or trade Google user data.
• Scope note: the commitments in this section concern Google user data obtained through the Google Workspace APIs described in §5.1. The email address on your DeepSpace account (however you signed up, including via Google sign-in) is part of our own account records; its only advertising-related use is the one-way-hashed conversion-measurement report described in §4 and §8, which involves no ad serving, retargeting, personalization, or interest-based advertising.
• DeepSpace does not use Google user data, including data accessed through the Gmail API, to develop, improve, train, fine-tune, or evaluate any generalized or non-personalized artificial-intelligence or machine-learning model. Google user data is not transmitted to Anthropic, OpenAI, Cerebras, Google Gemini, ElevenLabs, or any other third-party model provider listed in §4.1.
• DeepSpace personnel do not read or otherwise access Google user data, including data accessed through the Gmail API, except (a) with the user's explicit consent, for example to investigate and resolve a support issue the user has reported, (b) where strictly necessary for security purposes such as investigating abuse, fraud, or a suspected violation of these terms, (c) to comply with applicable law, or (d) for internal operations where the data has been aggregated and de-identified such that it cannot be linked to any individual user.

5.3 Storage, encryption, and processing location

• Gmail message content — headers, bodies, attachments, and labels — is retrieved on demand from the Gmail API at the moment a user views it within a connected DeepSpace app, transmitted to the user's authenticated browser session, and is not persisted in DeepSpace's databases or backups. An app developer can choose to copy content into the app's own data collections; in that case the developer's own retention and deletion rules apply.
• OAuth access and refresh tokens issued by Google are stored encrypted at rest. Encryption is applied at the application layer using AES-256-GCM with a per-record random initialization vector. The encryption key is derived via HKDF-SHA256 from a secret managed outside of the database and held only in the worker runtime, in addition to the encryption-at-rest provided by the underlying storage platform.
• All processing of Google user data takes place on Cloudflare Workers infrastructure operated by DeepSpace, within the same Cloudflare account that runs the DeepSpace platform. Google user data is not passed to any sub-processor listed in §4.1 other than Cloudflare, and is never passed to a sub-processor that is not listed in §4.1.
• DeepSpace enforces application-layer access controls, request rate limiting, audit logging, and security response headers on the endpoints that handle Google user data, in keeping with the Cloud Application Security Assessment (CASA) Tier 2 requirements applicable to applications that request Gmail restricted scopes.

5.4 Revoking access and deleting Google user data

• DeepSpace immediately calls the Google OAuth token revocation endpoint to revoke the OAuth grant on the Google side.
• The encrypted access and refresh tokens are deleted from DeepSpace's database.
• No further Gmail data is fetched on the user's behalf after revocation.
• Because DeepSpace does not persist message content server-side (see §5.3), there is no server-side message store to delete in addition to revoking the token.

5.5 Contact regarding Google user data