Runtime LLC, 1500 N Grant St Ste N, Denver, CO 80203, United States ("Runtime", "we") decides how the personal data described here is used. In European terms, we are its controller. Write to legal@withruntime.com about anything on this page.
This policy covers people who visit withruntime.com, hold an account or write to us. It does not cover what customers put inside their sandboxes and other resources. The customer decides what that data is. We process the data only for the customer, under the Data Processing Addendum. If your data is in a customer's product, ask that customer.
What we collect and why
Your account. Your email address, and, if you use "Continue with Google", the name and profile picture Google gives us. We use them to sign you in, to run your account and to write to you about it. For each session, we keep the IP address and browser description it was opened from, to protect the account. When you sign in, we record which version of the Terms of Service was in force. We also record the time, your email address, IP address and browser description, as proof of the agreement. We keep that record after the account is closed, for as long as a claim about the agreement could be brought.
Payments. Stripe collects your card details. We never see or store the card number. We keep what Stripe tells us about a payment: the amount, currency, date, status and Stripe's references. We use it to credit your balance, handle refunds and disputes, and meet tax and accounting law.
Support and feedback. What you write to support, in the chat, by email or from your agent through the CLI or MCP, and the replies. An AI agent handles support first. To help with a conversation you start, it reads your organization's account. It looks inside a sandbox only after you approve that. The conversation and what the agent read for it go to the AI model hosts listed as our subprocessors. We keep conversations while your account is open and for one year after it closes, to answer follow-ups and improve support. Feedback you send, including what you tell us about other providers, is kept to decide what to build and to tell you when it ships.
Usage. What you create and run, when, its size, what it cost, and which key or person did it. We use this to provide and bill the Services and to show you your own usage.
Network records. For each sandbox we keep a bounded record of the outside addresses and ports it connected to, when, for how long, and how much went each way. We also total, for each account and each hour, how much it sent to and received from each site, named only by its domain (for example example.com), or for a bare address only by its network, never the pages or content within it; traffic through your own proxy is counted only by host and port. We keep those totals for 7 days. We use these records only to trace and stop abuse and to answer complaints about traffic from our network.
Messages. What you send us by email, and our replies.
Visits to the site. We count visits ourselves. No analytics company is involved. A visit records the page you opened (for example, one docs page) and the time. It also records the name of the site that sent you, if your browser gives it (for example "news.ycombinator.com", never the address of the page you were on). It records whether you came from a search engine, a social site, another site or directly. It also records your country, worked out from your connection, and whether you used a computer, a phone or a tablet. If the link you followed was tagged with a campaign (for example "utm_source=newsletter"), the visit records those tags too.
If you came from an ad, the link usually carries an identifier the ad network added to it (for example, Google's "gclid"). The visit records which network it was, such as Google, Microsoft or Meta. When the ad was Google's or ChatGPT's, and you are outside the European Economic Area, the United Kingdom and Switzerland, we also keep that identifier for 90 days. If you then sign up, or make a payment within those 90 days, we tell that network. We send it back the identifier, which conversion it was, when, and, for a payment, the amount of credit bought. That is all it gets: never your name, email address or anything else about you. The network can still match the identifier to its own record of the ad you clicked. We do this so the network can tell which of its ads bring customers.
When you arrive from an ad, we also add one to a count of arrivals for that ad and page for the day, as soon as the page opens. This lets us know how many people an ad brought, even if they leave in the first seconds. That count keeps only the day, the ad network, the ad's campaign tag and the page: nothing that could tell you from anyone else, not even the code described below. We also count a few clicks on the site, such as copying the setup prompt or starting to sign in, with the page they happened on. We also record a code that stays the same on every visit from the same browser, so we can tell a new visitor from one who comes back. The code is made from a random identifier kept in your browser's storage. We do not store your IP address with a visit, and we do not track you across other sites.
If you sign in, we link the visits counted in that browser to your account. This lets us see how you found us. For example, we see the first site that sent you, the page you landed on, the pages you opened and the buttons you pressed before you signed up, and how many visits you made before you bought credit. If you start signing in in one browser and finish in another, as when an email link opens in your mail app, the sign-in link carries the first browser's random identifier, so its counted visits are linked too. It carries nothing if that browser's visits are not counted.
Programs reading the docs. When a program or an AI agent fetches the plain-text versions of our docs or our llms.txt file, we count the fetch: the day, the page, the kind of program as it describes itself (for example "curl" or "Claude"), and the country worked out from the connection. That is all we keep. No code, address or other detail that could tell one reader from another is stored, so this count asks for no agreement.
We count nothing if your browser sends Global Privacy Control. We do not act on the older Do Not Track setting. In the European Economic Area, the United Kingdom and Switzerland, we count only if you agree when asked. You can change your mind at any time from the "Privacy choices" link at the foot of this page. Clearing your browser's storage gives you a new code, which we cannot join to the old one.
We use no advertising cookies and no third-party trackers. No ad network's code runs on our pages. Signing in sets the cookies needed to keep you signed in. Following someone's referral link sets one cookie. It holds only their referral code, for 30 days, so that the credit reaches you both when you sign up. It is part of what you asked for, so we set it without asking. The page that link opens shows the name of the organization that shared it, unless that organization turned this off.
Legal grounds, for people in Europe
We use account, payment, usage and message data because we need it to perform our contract with you. We keep session and network records, and prevent abuse and fraud, because we have a legitimate interest in a secure service that outweighs the limited effect on you. We keep billing records because the law requires it. We count site visits with your consent.
Who receives it
The companies listed as our subprocessors, who act on our instructions. Authorities, courts or other parties when the law requires it, or when needed to establish or defend legal claims or to stop abuse. Our own infrastructure providers, when we must answer an abuse complaint about traffic from your resources. A successor, if our business is merged, sold or reorganized.
Google and OpenAI, as described under "Visits to the site", when you came from one of their ads and then signed up or paid. Each uses what we send under its own privacy terms.
We do not sell personal data. Telling an ad network about a conversion may count as "sharing" for advertising under some US state laws. Global Privacy Control stops it, as it stops all counting. Choosing "No thanks" under "Privacy choices" at the foot of this page also stops it.
Where it goes
We and our subprocessors are in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to us or by us, the transfer relies on the European Commission's standard contractual clauses, with the United Kingdom and Swiss additions where they apply. Write to legal@withruntime.com for a copy. Where one of our subprocessors is certified under the Data Privacy Framework, our transfer to it may rely on that instead.
How long we keep it
- Account data: while the account is open. When you close it, we delete or anonymize it within a reasonable time, except as below.
- Billing and tax records: seven years.
- Session and network records: for a limited period, and longer only for the specific records that are evidence of abuse or of a dispute.
- Hourly traffic totals by site: 7 days.
- Messages: up to three years after the conversation ends.
- Ad click identifiers: 90 days.
- Visits: kept without a time limit, so we can compare years. Visits linked to your account are covered by your rights below: ask, and we will send them to you or remove the link to your account.
- Backups of our account database: an encrypted copy each night, kept 30 days. Something deleted from the database leaves the backups within 30 days.
- Backups of what your sandboxes keep: copies of your volumes and snapshots, encrypted with your organization's own key, are kept off the server for the retention you set (1 to 365 days, 7 by default). Each server's nightly backup, encrypted with that server's own key, is kept 30 days, and its pieces leave the storage within 44. Closing your organization destroys its key first, so the copies only it opens become unreadable immediately.
A separate, optional recovery store, with hourly and daily recovery points, is not enabled today. If it is enabled, its configured retention keeps hourly and daily recovery points and preserves a last available and last restore-checked copy while the resource is retained. Deleting the resource or closing the organization ends that preservation rule. Cleanup waits for any active restore to finish, then removes recovery references and reclaims unused repository data. Provider object history is cleared separately under its configured deletion rules. Removal from the recovery catalog alone is not immediate physical erasure. We monitor delayed cleanup rather than silently retaining deleted content indefinitely. Customer resource backups are covered by the Data Processing Addendum.
Your rights
You may ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to our use of it, or to hand it to you in a portable form. Where we rely on consent, you may withdraw it at any time. Write to legal@withruntime.com from the address on your account. We respond within the time the law allows, and we never charge for a reasonable request. We will not treat you worse for asking.
To close your account, an owner can close it from the account's Close account
page or with runtime account close. You can also write to support@withruntime.com.
If you are in Europe, you may also complain to your data protection authority. If you live in a US state with a privacy law, the same rights apply to you. You may appeal a refusal by replying to it. We honor Global Privacy Control signals.
Security
Each sandbox is its own virtual machine. Connections are encrypted in transit, customers are separated inside the database, and access to systems is limited to what each part needs. No service is perfectly secure. If a breach of your personal data is likely to put you at risk, we will tell you.
Children
The Services are for businesses and adults. We do not knowingly collect personal data from anyone under 18.
Changes
We post changes here, and the date at the foot of the page shows the last one. If a change matters, we tell account holders by email or in the account.