Legal

Privacy policy

Last updated October 5, 2026. What we store about you, why, and who else sees it.

01What this covers

This policy explains what EnvStash ("we") stores when you use envstash.co, the dashboard, and the envs command-line tool, and what we do with it. It is written to be read: if something here is unclear, email us and we will answer.

02What we store

  • Your account: the email address, name, and profile picture URL that GitHub or Google gives us when you sign in, plus that provider’s numeric ID for you and your GitHub username.
  • Your GitHub connection: the access token GitHub issues us and the scopes it carries. The token is stored encrypted.
  • Your env files: the project names, file names, key names, and values you push. Values and whole-file contents are encrypted with AES-256-GCM before they reach the database.
  • Your sessions: a record of each sign-in, when it was last used, and when it expires or was revoked.
  • Your devices: for each machine signed in with the CLI, a label, when it was created and last used, and a SHA-256 hash of its token. The token itself is never stored.
  • Login requests: when a CLI login is started, the IP address and browser or client identifier it came from, so the person approving it can see who asked.
  • Abuse counters: short-lived counts of login and approval attempts per IP address, device, or account, used for rate limiting and swept after a day.

03What we do not collect

  • No passwords. Sign-in is through GitHub or Google only.
  • No advertising or analytics trackers on this site.
  • No payment details. Early access is arranged by email.

04How we use it

We use this data to run the service: to sign you in, to store your env files and hand them back to machines you have signed in, to show you your own projects and devices, and to slow down abuse. We do not sell it, and we do not use the contents of your env files for anything other than storing and returning them to you.

05Who can see your secrets

Your values are encrypted at rest, so a copy of the database alone does not reveal them. The encryption is server-side: the application holds the key and decrypts a value when you pull or reveal it. That means the service is technically able to read your values. It is not end-to-end encrypted, and we would rather say so here than let the word "encrypted" imply more than it does.

06Who else processes your data

  • Vercel hosts the application and sees request metadata such as IP addresses.
  • Neon hosts the Postgres database, which holds the records listed above, with secret values as ciphertext.
  • GitHub and Google handle sign-in, and learn that you signed in to this service.

07Cookies

We set one essential cookie that keeps you signed in, and short-lived cookies during sign-in that protect the login flow. Your light or dark theme choice is kept in your browser’s local storage. There are no third-party or tracking cookies.

08Keeping and deleting

You can delete env files and revoke devices from the dashboard at any time. Sessions lapse after 30 days unused and device tokens after 90. To delete your account and everything stored under it, email us from the address on the account.

09Changes and contact

If this policy changes in a way that matters, the date above changes with it. Questions, or requests about your data, go to hello@envstash.co.