Privacy Policy

Simple Host and Simple Hack · last updated 2026-10-23

Simple Host is made and run by Vineet Sriram.

Who we are

Simple Host and Simple Hack are run by Vineet Sriram, an individual (“we”, “us”). This policy covers simple-host.app, simple-hack.app, and the websites we host for their users. It applies to site owners and visitors, event organisers, participants and judges, and people connecting an AI app to either service. Accounts on Simple Host and Simple Hack are separate.

The rules for using the service are in the Terms of Service.

Simple Hack events and team projects

When you create or join an event, we keep your account email, chosen display name, event role, team membership and code-of-conduct acceptance. We keep the event details its organiser provides, sign-up answers and approval decisions, team and entry details, uploaded project files, invitations, judging assignments, conflicts, scores, comments and published results so the event can run.

• Public pages. Event descriptions, public entry galleries, team project websites and published results are visible to anyone with their address. The organiser chooses whether published results show winners only or the full ranking. Files published in a team website are public.
• Event access. Organisers can read the event's member names and email addresses, entries and judging data. Team members share their team's project and saved data. A judge sees the projects and scoring information allowed by their event role and assignments. The operator can access these records for running the service, support and moderation.
• Private results. Raw judging scores and comments are not part of the public ranking. After results are published, a team can see its own result and judges' comments without the judges' identities. Other teams cannot read that private result.
• People’s-choice votes. For optional event voting, we store the canonical form of your verified sign-in email (lowercased, with a +tag removed) and your selected team. This limits each account to one changeable vote per event and prevents own-team votes through email aliases. Votes remain until the event is deleted. Public results show team totals, never voter identities.
• Email. Resend receives the recipient address and message for sign-in codes, account notices, organiser announcements, first-entry receipts and event archive-removal warnings. We keep delivery records to send event messages and monitor accepted requests and failures. The event organiser can see participants' email addresses; ask the organiser about any separate use of them.
• Retention and requests. After an event is archived, hosted team websites normally remain for 30 days and then move to Recently deleted for 7 days; the operator can extend retention. The event page, entries and results remain. Use Simple Hack's Account page for account settings and deletion. For a copy or correction of event records, or help removing them, contact the organiser or support@simple-host.app. The site-dashboard controls described elsewhere on this page refer to Simple Host.

Simple Hack's AI-app connection

The connector at https://simple-hack.app/mcp uses Simple Hack sign-in and asks you to allow either Manage my events or one team's project. An event connection can list and create your events, read and edit their settings and rubrics, change stages, and retrieve score and result exports according to your organiser permissions. A team connection uses that team's website tools, including its files and permitted saved data. It cannot manage events or another team's project.

We receive the tool arguments the AI app sends, such as event details, rubric settings or project files. We send back the requested event details and invite links, role-permitted score/result exports, or team website information and saved data. The AI app then handles that information under its own privacy policy. We receive neither your full chat history nor unrelated conversations. Connection tokens are stored as hashes, access tokens last one hour, and rotating refresh tokens expire after 90 days without use. In Simple Hack's Account page, Sign out everywhere revokes connected apps and keys. You can also remove the connector in your AI app; revoking its server access requires signing out everywhere. Request logs follow the retention rules below.

What we collect when you have an account

• Email address. Used to sign you in. We get it when you enter a code we emailed you, or when Google confirms a verified address. It is your account name. You can change it under Sign-in on your page: we send a code to the new address, and a notice to the old one.
• Sign-in alerts. After each sign-in, or when you connect an app, we email you the time and the browser or app in a few words (such as "Chrome on macOS"), never your IP address or location. To send at most one a day per browser, we keep that short description and the date for two days. You can turn the alerts off under Sign-in on your page.
• Google account ID. If you use Google, we keep Google's ID for you and the verified email it last sent, so you land in the same account next time. We do not keep your name, picture or Google password, or any access to your Google account.
• How your account was created. When your account is made we note how: on our website (with an emailed code or Google), through which AI app you connected (such as ChatGPT or Claude), or the name an agent gave itself (such as "curl"). Not your IP address. Only we see it, on our admin page.
• Profile details you choose. Your handle and display name, if you set them.
• API keys and connection tokens. Used to prove requests come from you. We store them only as one-way hashes, so we cannot show you a key again.
• Your sites. The files you upload, each version, the site name, and any domain or free <name>.simple-host.app address you connect.
• Data your sites save. Lists and state that your pages or your AI app save.
• Request records. Times of requests and IP addresses, used for rate limits, security and investigating abuse. Our records of API calls keep only a shortened IP address (the network part); the web server's log keeps the full one. See how long we keep things.

If you visit a site hosted here

Sites on Simple Host are made by their owners, not by us. The owner decides what the site shows and what it asks you for.

What the site asks you for

• It belongs to the site's owner. Anything you type into a site (an RSVP, a comment, a survey answer, an order) is collected by that site's owner. We store it for them. The owner sees the address you were signed in with next to each entry you send and each change you make to the page's saved data (a vote, a like, an edit); other visitors never do. When an entry or a page's saved data is changed or deleted, the earlier copy is kept for 30 days so the owner can restore it, then removed. Ask the owner how they use it, or ask them to delete it. If you delete your own Simple Host account, the entries you sent to other people's lists while signed in are deleted with it, and your address is taken off the changes you made to their page data (the page data itself is the owner's and stays). Changes made without signing in, and public-list entries sent before lists recorded who sent them, are not linked to you, so they stay; for help with those, write to support@simple-host.app.
• Most saved data is public. Unless a list is private, anyone can read what you submit. Do not submit anything you would not want public.
• Private lists. The owner can make a list private. Only the owner and the Simple Host operator can read it all; you can see and change what you sent. The operator reads private lists only when needed for moderation, security, support or the law.
• Personal records. Some sites keep a record that is yours alone, such as saved progress or a habit tracker. Simple Host's owner tools never show it to the site's owner. The site's own pages run in your browser and can read it, so it is only as private as the site you use it on.
• Your email goes with private submissions. To add to a private list you sign in, and your verified email is saved with what you submit. The site owner sees it.

Signing in on a site

Some sites ask you to sign in with Google or an emailed code before you save. That creates a Simple Host account under your email. You get a sign-in cookie for that site's address, which lasts up to 30 days and covers that one site only. Signing in with Google also sets a short-lived cookie there for about 10 minutes, so the sign-in can finish only in the browser that started it. The page never gets your API key, and nothing records your name on public lists.

One account is used for every site you sign in to. We can see that link. We do not show it to the sites.

Visit counts

When you open a page hosted here, we count the visit so the site's owner can see how many people read it.

• Nothing is added to the page. There is no analytics script, no tracking cookie and no browser fingerprint. The count comes from our web server's own log.
• The server log records the time, the address asked for, the result, your IP address, your browser's User-Agent, and the domain of the page that linked you there (the referring domain, such as news.ycombinator.com; never the full address of that page). Log files are deleted after 30 days.
• The analytics database does not keep your IP address. It keeps a scrambled version (a hash made with a secret key that stays on our server), the country your IP is in, the site, the hour, and whether the visit looks like a person, a bot or our own monitoring. For visits by people it also counts, per day, which page of the site was viewed and which referring domain the visitor came from, so the site's owner can see their top pages and where visitors came from. Those counts are not linked to your IP address or its hash. The User-Agent is not kept there.
• The hash is a lasting identifier. The same connection produces the same hash on different days. That is how unique visitors are counted, and it means visits can be linked over time.
• Countries are looked up on our server, using a local copy of a public database (IP Geolocation by DB-IP, CC BY 4.0). Your IP is not sent anywhere for this.
• Who sees counts. Site owners see visit counts and countries for their own sites. We see them for all sites. Nobody is shown your IP address or the hash.
• Analytics records are deleted after 400 days, or when the site is deleted. There is no opt-out, because blocking cookies or sending do-not-track does not change a server log.

When a page saves data (a comment, an RSVP), that is an API call. API calls record a shortened IP address (the network part, not your exact address) for 30 days, so abuse can be investigated. Only we can see those records.

Using Simple Host from an AI app

The Simple Host connector (also called a plugin; address https://simple-host.app/mcp) lets an AI app such as ChatGPT, Claude or Grok work on your sites for you.

• Signing in. You sign in on simple-host.app and choose Allow. The app gets an access token that lasts one hour and a refresh token that it uses to get new ones. A refresh token is replaced each time it is used and expires after 90 days without use. Together they can publish, change and delete your sites and their data, and nothing else. We store only one-way hashes of them.
• What we receive. Only what the app sends when it uses a Simple Host tool: site names, files, data to save, domain names, the emails or domains you allow or block from saving on a site, and similar. We do not receive your chat history or the rest of your conversation.
• What we send back. Depending on the tool: your account email, handle and display name; your sites, files, versions and addresses; a site's domain and its status; saved data (including private lists you own), with the email address a visitor was signed in with when they sent an entry or made a change; who may save on a site; visit counts, a site's most viewed pages and the domains its visitors came from; and a 10-minute download link for a copy of a site. Personal records are never sent: only how many people have one. We do not send account IDs, IP addresses or visitor hashes. The app then handles that data under its own privacy policy.
• What we keep. Connector requests are logged like other API calls, including the shortened IP for 30 days. We keep a record of each connection (which app, the browser you allowed it in, in a few words such as "Chrome on macOS" so you can tell two connections apart, when you connected, when it was last used) until you disconnect it; never your IP address. We do not record what you asked the app.
• Disconnecting. Sign in at simple-host.app/dashboard and choose Disconnect under Connected apps. Sign out everywhere also disconnects every app.

A coding agent that uses your API key works the same way: its requests are made as you.

Building with the AI in Simple Host

• UpCloud sign-up link. The setup helper recommends UpCloud for running your own server. Its "Create your UpCloud account" button is a referral link: if you follow it, UpCloud learns you came from us, as with any referral, and gives new accounts the credit it describes. The page never asks for, sends or stores UpCloud credentials; the prompt it gives your AI agent tells the agent to use the ones you set in your own terminal and never to show or save them.

How we use it

• To sign you in, host and serve sites, and run the data each site saves.
• To show site owners, and us, how many people and bots visit.
• To enforce limits, keep the service secure, and investigate and act on abuse and reports.
• To answer your emails and handle requests.
• To follow the law and respond to lawful requests.

We do not sell personal data, share it for advertising, or use it to build advertising profiles. We do not send marketing email.

If privacy laws such as the GDPR apply to you, our legal bases are: running the service you asked for (contract), keeping it secure and free of abuse (legitimate interests), and meeting legal duties.

Who we share it with

• Resend, our email provider, which sends sign-in codes and account notices (sign-in alerts, email changes, deletion confirmations). It gets your email address and the message.
• Google, when you choose “Sign in with Google”. Google learns that you signed in to Simple Host.
• Cloudflare Turnstile, when you post on a site without signing in, where the site's owner allows that (the comments setting). Your browser runs Cloudflare's spam check in a small box from simple-host.app, and Cloudflare sees the signals it uses to tell people from bots. We send Cloudflare only the check's one-time result, never your IP address. See Cloudflare's Turnstile privacy addendum.
• AgentCat, which counts how AI apps use the Simple Host connector. For each tool call it gets the tool's name, how long it took, whether it failed (with our short error code), the app's name when it is a well-known app, and a one-way code for your account that it cannot turn back into your account or email. It never gets what the app sent or received, your email, your site names, or your IP address.
• Our hosting and backup providers. The service runs on rented cloud servers. Backups are encrypted before they are stored with a cloud storage provider, so it cannot read them.
• Site owners get what visitors submit to their sites, as described above.
• Authorities. We may share information when we believe the law requires it, or to protect people or the service. We report child sexual abuse material as the law requires.
• A new operator. If the service is transferred, for example to a company, your data goes with it under this policy.

No IP address is sent to any geolocation service. There are no other third parties.

Cookies

We use cookies to sign you in, on simple-host.app and on sites where you sign in, and one on simple-host.app to count where sign-ups come from. On a site these are __Host-sh_vsess, your sign-in for that one site (up to 30 days), and __Host-sh_vnonce, set for about 10 minutes while a Google sign-in finishes. There are no analytics or advertising cookies. When a link brings you to simple-host.app, we remember which link brought you, for 30 days at most, in a first-party cookie (__Host-sh_from), to count where sign-ups come from. The dashboard may also keep your sign-in in your browser's storage.

How long we keep things

• Account: until you delete it. Deleting it removes it and all its data at once.
• Sites, versions and saved data: until you delete the site. Earlier versions are kept so you can roll back. A deleted site is restorable for 7 days. Every change is kept for 30 days: the owner can restore earlier versions of saved data and deleted list items. The owner can delete entries in any list, and edit entries in a private list.
• Server logs: 30 days.
• Shortened IP addresses from API calls: 30 days.
• Analytics records: 400 days, or until the site is deleted.
• AI app connections: until you disconnect. Unused refresh tokens expire after 90 days.
• Sign-in cookies on sites: up to 30 days.
• The link that brought you (__Host-sh_from): 30 days at most.
• Backups: deleted data can stay in encrypted backups for about 14 days.
• Removed for abuse: we may keep content and account records longer when we must for legal reasons or to deal with abuse.

Your choices and rights

• Delete a site yourself at any time, from the dashboard or your AI app. It is restorable for 7 days from Recently deleted; then its files, saved data and analytics are removed.
• Get a copy of your data: choose Download my data in the Your data section of your page (sign in at simple-host.app/dashboard). You get one .zip file with every site, including any in Recently deleted (files, saved data and lists), your account details, your keys' names (never the keys), your connected apps, the sites you are signed in to as a visitor, every entry you sent to other people's lists while signed in, and every change you made to other people's page data while signed in (which site, what kind of change and when; changes made without signing in, and public-list entries sent before lists recorded who sent them, are not linked to you). Visitor analytics are not in it because they hold no personal data: visitors are counted by a salted hash, never by address.
• Delete your account and all its data: choose Delete my account in the same place, and type your handle (or your email, if you have no handle) to confirm. It happens at once and cannot be undone: every site with its files, versions, saved data and analytics, your keys and connected apps, and the entries you sent to other people's lists while signed in. Your address and your sites' names are retired, never given to anyone else. We email you when it is done. Copies in backups are gone within about 14 days.
• Correct your details: change your sign-in email under Sign-in on your page; for anything else, email us and we will fix them.
• Data a site collected from you: ask that site's owner first. If you cannot reach them, or the site is abusive, email us with the site's address.

Depending on where you live, you may have more rights, such as to object to how your data is used, or to complain to your data protection authority. Email support@simple-host.app to use them, or if you cannot use the buttons above. We answer within the time the law requires.

Security

We use HTTPS everywhere, store keys and tokens as hashes where we can, and limit access to the operator. No system is perfectly secure. Do not use Simple Host for sensitive data such as payment cards, health information, government ID numbers or passwords.

Where data is processed

Our servers are in the United States. Your data may be processed in the United States and in other countries where our providers work, which may have different privacy laws from yours.

Children

Simple Host is not directed at children under 13, or under the higher age your country sets. We do not knowingly collect their personal data. If you believe a child has given us personal data, email us and we will delete it.

Changes to this policy

We may update this policy. The date at the top shows the latest version. For significant changes, we will try to give notice on the site or by email.

Contact

Questions, data requests, or reports: support@simple-host.app. For help using the service, see Support.