Privacy policy

Information handled during installation

When an administrator installs Anycloud, Slack redirects the browser to our OAuth callback with a short-lived authorization code and state value. Our Cloudflare Worker exchanges that code with Slack and receives installation metadata, an OAuth access token, and the incoming webhook URL for the selected channel.

The Worker uses only the webhook URL to render a protected copy control. It does not persist the authorization code, OAuth access token, workspace metadata, or webhook URL. The OAuth access token is discarded immediately. The callback does not use application analytics, and its responses are marked as non-cacheable.

Information stored on your Anycloud server

After an operator pastes the webhook into the hidden CLI prompt, the CLI hands it to the Anycloud API that will send the notifications. That API stores the incoming webhook URL in its own database, encrypted at rest with the same key it uses for cloud credentials and secrets. It remains there until an operator disables Slack notifications.

The Anycloud API reads deployment activity and compute-spend information from its local database to create daily summaries and spend-cap alerts. It sends the resulting message directly to the selected Slack channel. Cloud-provider credentials are not included in these messages or sent to the installation service.

Slack data we do not collect

The app requests only Slack's incoming-webhook permission. It cannot read channel history, messages, users, files, reactions, or workspace directories. It does not subscribe to Slack events or use Slack content to train machine-learning models.

Retention and service providers

• OAuth and webhook values exist in Worker memory only for the duration of the installation request and are not retained by the Anycloud application.
• Cloudflare processes network requests as our hosting and security provider. Worker application logging and observability are disabled for the OAuth flow.
• Slack receives and retains messages according to the installed workspace's Slack plan, settings, and retention policy.
• The public pages on anycloud.sh use the website's standard analytics. Those pages do not receive OAuth codes or webhook URLs, which are handled on the separate slack.anycloud.sh callback.

Access, transfer, and deletion

Anycloud does not maintain a hosted account or dataset containing Slack workspace content for this integration. A server operator can inspect or remove the stored configuration at any time:

A Slack administrator can uninstall Anycloud to revoke the workspace installation and its webhook. To request information, assistance with deletion, or a transfer of any data you believe Anycloud holds, email support@anycloud.sh.

Security

Treat the webhook URL as a secret. Never commit it to source control or include it in support messages. Anycloud uses TLS for the OAuth flow and webhook delivery, validates the Slack webhook host, protects the OAuth flow with a short-lived state cookie, keeps terminal input hidden, and does not place the webhook URL in a browser URL.

Changes and contact

We may update this policy when the integration changes. The effective date above will identify the latest version. Questions and privacy requests can be sent to support@anycloud.sh.