Privacy Policy

1. Summary

27c.site contains no advertising, no tracking, and no analytics — not on these pages, and not on the sites we host. We collect only what running your hosting account requires: a username, a hashed password, a subdomain, the files you deploy, and basic deployment metadata. We never sell personal data.

2. Information We Collect

When you create an account, we collect and store the following:

• username (chosen by you, used as or associated with your subdomain);
• a password, stored only as a salted PBKDF2-SHA256 hash — we never store plaintext passwords;
• your assigned or custom subdomain;
• the static files you deploy (HTML, CSS, JS, images, videos, etc.);
• deployment metadata (timestamps, file names and sizes) used for deployment history and rollback;
• data your sites store through the built-in storage feature (see section 6).

3. Cookies

The platform sets exactly one cookie: 27c_lang, which remembers whether you prefer the English or Chinese interface. It is a strictly functional cookie: it lasts one year, is never used for tracking or advertising, and is not shared with anyone. No other cookies are set — there is no consent banner because there is nothing to opt out of.

4. Server Logs

Requests to the platform are logged for security and troubleshooting: a random request id, HTTP method, URL, response status, and duration. These logs are used to operate and debug the Service only; they are not used to build advertising, marketing, or behavioral profiles.

5. Information We Do NOT Collect

We do not collect your email address, real name, billing information, payment details, or precise location. We do not run ads, advertising analytics, cross-site tracking, or fingerprinting, and we do not sell or share personal data with third parties for marketing.

6. Visitor Data Stored by Hosted Sites

Hosted sites can store visitor-submitted data — for example form submissions, comments, messages, or likes — through the platform's built-in storage API. If you submit data to a hosted site: the site's owner decides what is collected and why, and is the controller of that data; 27c.site stores it on their behalf as a processor. Site owners are responsible for the lawfulness of that collection and for providing their own notice; when in doubt, check the privacy notice of the specific site you are visiting.

7. Agent Sessions and API Keys

When you connect an AI agent through the MCP server, the API key returned by register or login is cached server-side for that MCP session and expires automatically, so later tool calls stay authenticated. No API key is written to your browser's local storage, and the key is never surfaced back to you in plain text.

8. How We Store and Protect Data

Passwords are hashed with salted PBKDF2-SHA256. Each account's files are stored in an isolated, per-user storage space, and the Service validates file paths to block traversal. All traffic is served over HTTPS.

9. Data Retention

We retain your account and deployed content while your account is active. Deployment history is retained (typically the most recent deployments) to support rollback and may be pruned to manage resources. Visitor data stored by your sites is kept while your account exists; deleting your account removes it and all associated data.

10. Infrastructure Processors (No Ad or Analytics Vendors)

The Service runs on Cloudflare (edge delivery, Workers, KV, and R2 storage) and uses Neon (managed Postgres) for the built-in storage API. These providers process data solely to operate the Service. Content may be served from edge locations worldwide, which can involve international transfers. No third-party advertising, analytics, or tracking vendors are used anywhere in the Service — on platform pages or on hosted sites.

11. Children's Privacy

The Service is not directed to children under 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

12. Data Deletion and Your Rights

You can delete your account and all associated data — including your deployed content, deployment history, stored site data, and API keys — at any time, yourself, with no need to contact us. Use the delete_account MCP tool (your agent will ask you to confirm) or send DELETE /api/account with { "confirm": true } and your API key (see /docs). Deletion is immediate and irreversible.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available at this page with an updated date.

14. Contact

For privacy questions or data requests, please contact the service operator at contact@violet27chen.com.