Privacy Policy

1. Who We Are

ComposeHub ("Service", "we", "us", "our") is operated by Liberty Digital Agency LLC, a limited liability company registered in the State of New Mexico, USA.

Mailing Address: 6300 Riverside Plaza Lane NW, Suite 100, Albuquerque, NM 87120, USA

Privacy Contact: [email protected]

General Contact: [email protected]

2. The Editor is Client-Side

The ComposeHub visual editor runs entirely in your web browser. Your Docker Compose YAML content is processed locally on your device and is never transmitted to or stored on our servers while you use the editor. We have no access to the configurations you create or edit unless you explicitly choose to share them as a public stack.

3. Account Data We Collect

When you create a ComposeHub account, we collect and process the following personal information:

• Email address — for authentication, account recovery, and service communications
• Display name and avatar — from Google OAuth if you sign in with Google, or as provided by you
• Payment information — processed securely by Stripe. We never store your credit card numbers, CVV, or full card details on our servers. We retain only a Stripe customer ID and subscription status.
• Usage metadata — account creation date, subscription plan, and feature usage (e.g., number of shared stacks)

Legal basis (GDPR): We process account data based on contractual necessity (Art. 6(1)(b) GDPR) to provide the service you signed up for, and legitimate interest (Art. 6(1)(f) GDPR) for service improvement and security.

4. Shared Stacks

When you share a stack publicly on ComposeHub, the YAML content, title, description, and tags are stored on our servers and become publicly accessible to anyone on the internet. This content may be indexed by search engines and cached by third-party services.

You are solely responsible for ensuring your shared stacks do not contain real passwords, API keys, tokens, secrets, or other sensitive information. We are not liable for any exposure of credentials included in publicly shared stacks.

5. Cookies

We use only essential cookies that are strictly necessary for the functioning of the Service:

• Authentication session cookie — to keep you signed in
• User preference cookies — such as dark mode and cookie consent status

We do not use tracking cookies. However, third-party advertising networks (if displayed on the site) may set their own cookies. These are governed by the respective third-party privacy policies.

6. Analytics

We use Plausible Analytics, a privacy-first, cookie-free analytics service that is fully GDPR, CCPA, and PECR compliant. Plausible does not collect personal data, does not use cookies, and does not track users across websites. We receive only anonymous, aggregate data about page views and usage patterns. No personal information is ever sent to Plausible.

For more information, see Plausible's Data Policy.

7. Your Rights Under GDPR (EU/EEA)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion of your personal data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to restrict processing — request limitation of how we process your data
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

8. Your Rights Under CCPA/CPRA (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to delete — request deletion of your personal information
• Right to opt-out of sale — we do not sell your personal information to third parties
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights
• Right to correct — request correction of inaccurate personal information
• Right to limit use of sensitive personal information — we do not collect sensitive personal information beyond what is necessary for the Service

To exercise any of these rights, contact us at [email protected]. We will verify your identity and respond within 45 days as required by law.

Do Not Sell My Personal Information: We do not sell, rent, or trade your personal information. We have not sold personal information in the preceding 12 months.

9. Data Sharing

We do not sell your personal information. We share data only with the following third-party service providers, solely for the purpose of operating the Service:

• Stripe (San Francisco, CA) — payment processing. See Stripe's Privacy Policy.
• Google (Mountain View, CA) — OAuth authentication (if you choose to sign in with Google). See Google's Privacy Policy.
• Plausible Analytics (EU-based) — anonymous, aggregate website analytics. No personal data is shared. See Plausible's Data Policy.

We may also disclose your information if required by law, subpoena, court order, or governmental regulation, or to protect our rights, property, or the safety of our users.

10. Data Retention

We retain your account data for as long as your account remains active. If you request account deletion, we will remove your personal data from our active systems within 30 days. Some data may be retained in encrypted backups for up to 90 days after deletion, after which it is permanently purged.

Publicly shared stacks are not automatically deleted when your account is deleted. If you wish to remove shared stacks, please delete them before requesting account deletion, or include the request in your deletion email.

11. International Data Transfers

Your data is processed and stored in the United States of America. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the USA. By using the Service, you consent to this transfer.

For EU/EEA users, we rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards where necessary to ensure adequate protection of your personal data during international transfers.

12. Children's Privacy

ComposeHub is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected] and we will promptly delete such information.

13. Data Security

We implement industry-standard technical and organizational measures to protect your personal data, including encryption in transit (TLS/HTTPS), secure authentication mechanisms, and access controls. However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify registered users via email at least 30 days before the changes take effect. The "Last updated" date at the top of this page reflects when the policy was last revised. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us:

• Privacy inquiries: [email protected]
• General inquiries: [email protected]
• Mailing address: Liberty Digital Agency LLC, 6300 Riverside Plaza Lane NW, Suite 100, Albuquerque, NM 87120, USA