🔒

Privacy Policy

Last updated: June 2025 · GDPR & CCPA compliant

Overview
Data We Collect
How Data Is Collected
How We Use Data
Data Storage & Retention
Data Sharing
Security
Your Rights
Children's Privacy
International Transfers
Third-Party Services
Policy Changes
Contact & DPO

1 Overview

CloudFormation is a browser-based infrastructure design tool. We are committed to protecting your privacy and being transparent about how we handle information. This Privacy Policy explains what data we collect, why we collect it, and how you can control it.

Key principle: Your infrastructure designs are processed locally in your browser. We do not have access to the cloud resources you design, the credentials you use, or the infrastructure you deploy.

GDPR & CCPA: If you are in the European Economic Area (EEA), United Kingdom, or California, additional rights apply to you. See Section 8 (Your Rights).

2 Data We Collect

2.1 Usage Analytics (Anonymised)

When you use CloudFormation, our built-in analytics system collects:

Data Type	What We Collect	Purpose
Anonymous Visitor ID	Randomly generated, stored in localStorage	Count unique visitors
Session ID	Randomly generated per session	Group related events
Page path	URL path (no query params with personal data)	Usage analytics
IP Address (hashed)	One-way SHA-256 hash with salt — not reversible	Geographic region detection
User Agent	Browser and OS type	Compatibility analytics
Event type	e.g. pageview, generate_terraform, export_zip	Feature usage insights
Feature metadata	e.g. cloud provider used, resource count	Product improvement
Time on page	Session duration metrics	UX improvement
Canvas actions	Types of components dragged, connections made	Product analytics

2.2 Data We Do NOT Collect

Your name, email address, or any contact information
Your raw IP address (only an irreversible hash is stored)
The actual content of your canvas designs or generated code
Cloud provider credentials, API keys, or secrets
Payment information
Location data beyond approximate geographic region from hashed IP

2.3 Local Storage Data

CloudFormation uses your browser's localStorage to save your canvas designs, settings, and preferences. This data:

Never leaves your device unless you use an export/share feature
Is not accessible to us
Can be cleared at any time by clearing your browser's site data

3 How Data Is Collected

3.1 Automatic Collection

Our lightweight analytics tracker (admin/assets/tracker.js) automatically sends a pageview event when you load the application. It also records interactions when you use features such as generating Terraform code, running security scans, or exporting projects.

3.2 What the Tracker Does NOT Do

Does not set cookies
Does not use fingerprinting techniques
Does not track you across other websites
Does not sell or share data with advertising platforms
Does not use third-party analytics services (e.g., Google Analytics)

3.3 Self-Hosted Deployments

If you deploy CloudFormation on your own servers, all analytics data is stored entirely on your own infrastructure. We have no access to analytics data from self-hosted deployments.

4 How We Use Data

We use collected analytics data to:

Improve the Service: Understand which features are most used and prioritize development
Fix bugs: Identify patterns in errors or unexpected behavior
Performance monitoring: Ensure the application loads quickly and works correctly
Security monitoring: Detect unusual access patterns that may indicate abuse
Product decisions: Understand which cloud providers and component types are most popular

We do not use your data for targeted advertising, profiling, or sale to third parties.

5 Data Storage and Retention

5.1 Analytics Data

Analytics events are stored as JSON-lines files on the server running CloudFormation. By default:

Daily log files are retained for 90 days
Log files are automatically pruned by a scheduled cleanup process
Raw IP addresses are never stored — only a non-reversible 16-character hash

5.2 Your Design Data

Canvas designs saved via auto-save are stored exclusively in your browser's localStorage. This data is not uploaded to any server and is cleared when you clear your browser site data.

5.3 Data Location

For hosted deployments, analytics data is stored on the server where CloudFormation is deployed. For self-hosted instances, data remains entirely on your own infrastructure.

7 Security Measures

We implement appropriate technical and organisational security measures:

IP addresses are hashed with SHA-256 and a random salt before storage
Admin panel requires authentication before accessing analytics data
Log files are stored outside the webroot where configured correctly
No raw personal identifiers are stored in analytics logs
HTTPS is recommended for all deployments (enforcement is your responsibility for self-hosted)

While we take reasonable precautions, no system is completely secure. We encourage you to report any security concerns through our Help Center.

8 Your Rights

8.1 For All Users

Opt out: You can disable analytics by blocking requests to admin/api/track.php using browser extensions or network rules
Clear local data: Clear your browser's site data to remove all locally stored design data and visitor IDs

8.2 GDPR Rights (EEA/UK Users)

If you are in the EEA or UK, you have the right to:

Access: Request a copy of data held about you (note: our analytics are anonymous and not linked to you personally)
Erasure: Request deletion of any personal data
Portability: Receive your data in a machine-readable format
Object: Object to processing based on legitimate interests
Restrict: Request restriction of processing
Complaint: Lodge a complaint with your local data protection authority

8.3 CCPA Rights (California Users)

Right to know what personal information is collected
Right to delete personal information
Right to opt out of sale (we do not sell personal information)
Right to non-discrimination for exercising these rights

To exercise your rights, contact us via the Help Center. Note that because our analytics use anonymous, hashed identifiers, we may not be able to link a specific request to a specific analytics record.

9 Children's Privacy

CloudFormation is intended for professional use and is not directed at children under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided personal information, please contact us and we will take steps to delete it.

10 International Data Transfers

For self-hosted deployments, data stays on your infrastructure regardless of location. For hosted services, where analytics data may cross international borders, we ensure appropriate safeguards are in place in accordance with applicable data protection law.

11 Third-Party Services

CloudFormation may load fonts or icons from third-party CDNs (such as Google Fonts or Tabler Icons). These requests may transmit your IP address to those services under their own privacy policies. You can review their policies at their respective websites.

Generated Terraform code references Terraform Registry (registry.terraform.io). Using that registry when running terraform init is subject to HashiCorp's privacy policy.

12 Policy Changes

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date. We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the revised policy.

13 Contact and Data Protection Officer

For privacy-related enquiries, requests to exercise your rights, or to report a data protection concern:

Email: privacy@cloudformation.dev
Help Center: cloudformation.dev/help

We aim to respond to all privacy enquiries within 30 days.