Privacy

What CloudChef stores in its own account

The operator control plane stores:

• your Cloudflare user identity and account details
• hashed authentication sessions
• encrypted OAuth credentials
• granted scopes and connection status
• user-runtime names and endpoints
• provisioning status
• narrow operational records

It also holds sampled service logs and, only if you opt in, allowlisted product telemetry.

The control-plane database does not store:

• prompt or transcript bodies
• project source
• deployment plans
• generated application data
• raw AI responses

Chat catalogs, transcripts, generated files, workspace state, deployment records, and generated Cloudflare resources are stored in the connected Cloudflare account. CloudChef accesses them to perform your requests, but does not copy them into the operator control-plane database.

Operator, scope, and roles

DOUS SOFTWARE INC., an Ontario corporation (Ontario Corporation No. 1001622428), operates CloudChef and is the controller for personal data CloudChef processes to operate the service. Its business correspondence address is 350 Bay Street, Suite 1300B, Toronto, Ontario M5H 2S6, Canada. This includes account, authentication, Cloudflare-connection, requested AI-building workflow, support, security, and optional product-telemetry processing. Persistent server-side project and conversation state remains in the connected Cloudflare account. You control that account and are responsible for processing performed by applications you publish. Cloudflare and GitHub also process data under their own terms and privacy roles.

Data, purposes, and legal bases

• Account and authentication: Cloudflare identity, name, email, avatar, session records, OAuth state, and connection status. These are used to authenticate you and provide the service you request, including steps taken before and during the service agreement. The identity and authorization fields are required to use signed-in features; without them, CloudChef cannot provide those features.
• Cloudflare connection: account identifiers, granted scopes, runtime locators, and encrypted credentials. These are used to operate the Cloudflare integration you authorize. Tokens, ciphertext, IVs, credential handles, and capability secrets are excluded from account-data responses.
• Projects and conversations: chat metadata, transcripts, generated files, revisions, validation receipts, deployment plans, approvals, and deployment status. These are processed and stored in the connected Cloudflare account to generate, recover, validate, and deploy your project under the service agreement. You choose what project content to provide, but CloudChef cannot perform a requested build without the content needed for that request.
• Service and security logs: sampled Worker invocation, Container, and trace metadata can include request method and path, Cloudflare request metadata, response status, timing, binding activity, and exception or diagnostic metadata.

  CloudChef control plane

  60% of Worker logs and 5% of traces

  Workspace runtime, in your connected Cloudflare account

  60% of Worker logs, and Computer container logs enabled

  Generated applications, in your connected Cloudflare account

  60% of Worker logs and 5% of traces

  These settings support operation, troubleshooting, and security under the operator’s legitimate interests. Prompts, source code, credentials, and raw tool output are not intended log fields.

• Support, privacy, and legal records: contact details, message contents, attachments, case metadata, and reports you submit. These are used for the operator’s legitimate interests in answering requests, protecting users and infrastructure, enforcing the Terms, and establishing or defending legal claims, or to meet a legal obligation.
• Optional product telemetry: allowlisted events, opaque journey or error-event identifiers, status values, and bounded numeric metrics. Consent is requested before CloudChef sends this telemetry. Prompts, source code, credentials, URLs, and direct user identifiers are excluded. The request omits browser credentials; a client IP supplied by Cloudflare is used transiently as a rate-limit key and is not included in the application event log.

AI processing

The user-owned workspace runtime sends the prompt, conversation context, and project files needed for a request to the configured builder model through Cloudflare AI in the connected account. The in-chat model selector loads the current Cloudflare-hosted catalog from that account and offers models compatible with the builder’s function-calling and context requirements. Paid-model calls are routed through the account’s default AI Gateway so accounts configured for Unified Billing can use prepaid credits; per-request controls skip AI Gateway caching and log collection. Cloudflare describes its handling of Workers AI content in its Workers AI data-usage notice. CloudChef does not use AI to make decisions that produce legal or similarly significant effects about you.

Browser storage and telemetry choice

Essential browser storage includes a 30-day authentication cookie, short-lived OAuth and recovery state, theme and builder-model preferences, and a pending prompt in tab-scoped session storage. Chat, transcript, and workspace presentation caches remain only in memory and are rebuilt from your Cloudflare account after a reload. Preferences remain until replaced or cleared in your browser.

Optional product telemetry is off until you allow it. Your choice is stored locally. CloudChef also honors Global Privacy Control and Do Not Track. Disabling telemetry stops future telemetry but does not remove events already received. You may withdraw telemetry consent at any time without affecting processing that occurred before withdrawal.

Where data is held and disclosed

Workspace metadata, Agent transcripts, project files, Computer state, previews, and generated infrastructure remain in the connected Cloudflare account. Data is disclosed only as needed to operate the service, follow your instructions, protect the service, or comply with law.

Cloudflare provides authentication integration, Workers, D1, R2, Durable Objects, Containers, Computer, Workers AI, the Cloudflare AI model catalog, observability, and related infrastructure. GitHub processes information submitted through public support issues or private security reports. Control-plane observability is held in the operator’s Cloudflare account; workspace, Computer, and generated-application observability is held in your connected Cloudflare account. CloudChef does not sell personal data, share it for cross-context behavioral advertising, or use it for targeted advertising.

International processing

Cloudflare and GitHub operate globally, so data may be processed outside your country. CloudChef does not currently offer a selectable residency region. Cloudflare describes its transfer safeguards, including Standard Contractual Clauses where applicable, in its Data Processing Addendum. Review Cloudflare’s Privacy Policy and GitHub’s privacy statement, which describes GitHub’s international data-transfer practices.

Retention in the operator control plane

In the operator control plane:

• OAuth authorization state expires after 10 minutes
• authentication sessions after 30 days
• unreferenced encrypted credential records become eligible for removal after 24 hours

Maintenance runs every 15 minutes in bounded batches, so backlog or retries can delay physical removal. Account, connection, and runtime-locator records remain while the account and service are active or until they are no longer needed or a verified request is fulfilled. There is no automatic inactive-account purge.

The operator’s current Cloudflare plan retains sampled control-plane Workers Logs and traces for seven days. CloudChef does not copy them to another log or trace store. Cloudflare may retain aggregate control-plane Worker metrics for up to three months; those metrics are not a user-addressable event ledger.

Cloudflare D1 Time Travel keeps control-plane database changes recoverable for up to 30 days under the current plan. User-owned D1 recovery windows depend on the user’s Cloudflare plan. CloudChef will not intentionally restore erased records from recovery history. If broader disaster recovery reintroduces them, the erasure must be reapplied unless a lawful retention exception governs.

Erasing and exporting operator-held records

Settings contains a self-service control that erases every record the operator holds for your account:

• identity and profile
• authentication sessions
• encrypted Cloudflare credentials
• connection metadata and granted scopes
• your runtime locator

It also asks Cloudflare to revoke CloudChef’s authorization, and tells you when Cloudflare did not confirm that revocation so you can remove it yourself. Because erasure is irreversible it requires a Cloudflare sign-in completed in the last ten minutes, an exact typed confirmation, and an explicit acknowledgement of what is retained. Repeating it is harmless. If you have already revoked CloudChef’s authorization you can no longer sign in, so use the request path below instead.

Settings also contains a self-service export of those same operator-held records. It saves a JSON file, carrying a schema version and an export timestamp, containing:

• your identity and profile
• your Cloudflare connection metadata and granted scopes
• the existence, storage time, and key version of your encrypted credential record
• your runtime locator
• your authentication-session and OAuth-state records

Encrypted credential material, initialisation vectors, credential handles, and session token hashes are never exported. Because a single file discloses your whole account record, the export requires the same Cloudflare sign-in completed in the last ten minutes that erasure requires. Each section is bounded at 200 records and reports the untruncated count beside them, and a section that could not be read is named in the file, which reports itself incomplete rather than looking whole.

What removal does not delete

That control deliberately deletes nothing inside your own Cloudflare account. Workers and their unpromoted preview versions, production and preview D1 databases, R2 buckets, KV namespaces, Containers, Durable Objects, and Agents that CloudChef deployed are retained, keep running, keep billing to your account, and are yours to remove. Chats, transcripts, project files, and deployment records also stay there under that account’s controls, and the account export does not contain them: download individual project source with Download code in the project header, and use your Cloudflare account’s own tools for the rest. The browser holds no persistent chat, transcript, or project replica. Its theme, model, telemetry-choice, and tab-session data are not reachable from the server and are in no export; the authentication cookie is sent with requests so the server can verify sign-in. Settings lists exactly what to clear.

Workspace Worker and Computer container logs, and generated-application Worker logs and traces, remain in your connected Cloudflare account. Their access and retention follow that account’s permissions, plan, product settings, and Cloudflare controls. CloudChef does not copy them into the operator’s log or trace store, and removing a project does not immediately erase provider-retained observability.

Removing a project hides it from the active project list and makes its Agent and workspace eligible for teardown no earlier than 30 minutes later. CloudChef also schedules deletion of the project’s generated Worker and all of its versions and Durable Objects, production and preview D1 databases, KV namespaces, and R2 buckets from your connected Cloudflare account. R2 objects are emptied in bounded batches before the bucket is deleted; provider failures or revoked authorization can delay cleanup and are retried while access remains available. It is not complete erasure: catalog, transcript, deployment, provider-retained observability, and browser records remain under their applicable retention boundaries. Browser data remains until you clear it. Delete projects and allow this cleanup to finish before deleting your CloudChef account data: account deletion revokes the authorization cleanup needs, so a project deleted inside this window keeps running and billing until you remove its resources in your Cloudflare account.

GitHub retains public support issues and private security reports according to its policies and repository controls. Records may also need to remain for security, fraud prevention, legal compliance, disputes, or backups.

Your choices and rights

Depending on applicable law, you may request access, correction, portability, restriction, objection, or erasure and may complain to the data-protection authority responsible where you live or where an alleged infringement occurred. Access to the records the operator holds, a machine-readable copy of them, and their erasure are all self-service in Settings, as described above. For everything else — correction, restriction, objection, data the operator does not hold, or a case the Settings controls cannot reach — start with the public Support form and include only the request type and your GitHub handle. If a private method can be arranged, a maintainer will identify it in the issue; until then, do not provide sensitive information. CloudChef does not yet provide a verified confidential privacy inbox.

CloudChef may request proportionate information to verify control of the relevant Cloudflare identity before disclosing or deleting data. Public-beta response targets are not legal deadlines; where privacy law sets a deadline, including the GDPR’s usual one-month period, that deadline governs. Some rights and deletion requests are subject to lawful exceptions, and current technical limits are described above rather than treated as a waiver of those rights.

Security and age limit

Controls include encrypted Cloudflare credentials, hashed session and capability tokens, same-origin checks, short-lived runtime capabilities, tenant binding, bounded request sizes, deployment approval, and security readback. No system is risk-free. CloudChef is for adults and is not directed to anyone under 18, who must not use the service.

Changes and contact

Material changes will be published with an updated version and effective date and, when practical, additional notice in the service. Use Support for privacy questions, sharing only the request type and your GitHub handle in the public form.