What we collect, and why.

This policy explains how dashql (“we”) handles personal information when you use the dashql web application at https://dashql.dev. It applies to visitors, registered users, and members of workspaces. Please read it alongside the Data & Security sections of the pricing page, which describe how we treat the data in your connected databases.

1. Information we collect

Information you provide

• Account information - email address, name, and a salted, hashed password. We never store your actual password.
• Workspace information - organization names, your role within an organization, and the email addresses of people you invite.
• Content you create - saved queries (SQL or MongoDB aggregations), version history of your queries, chart definitions, and dashboards.
• Database connection credentials - when you connect your own databases (PostgreSQL, Cloudflare D1), you provide connection details. These are encrypted with AES-GCM before storage and are used only to run the queries you execute.
• Support communications - if you contact us for help, we keep your message and contact details.

Information collected automatically

• Service logs - our hosting provider (Cloudflare) keeps technical logs such as request URLs, timestamps, and IP addresses so we can debug errors and protect the service from abuse.
• Session data - a short-lived sign-in token kept in your browser’s local storage so you stay authenticated.
• AI usage metadata - when you use AI features, we record which feature ran, its size and duration, and whether it succeeded. We do not store your prompts or completions in this log.

Query results from your databases

When you run a query, the result streams to your browser. Results are only kept when you opt in, and the cache policy is yours to set per data source: cache on our servers, cache in your browser only, or keep nothing at all. If results are cached, they may contain personal data from your own databases - dashql acts as a processor for that data, acting only on your instructions.

What we do not collect

• No advertising cookies, cross-site trackers, or analytics vendors.
• We never sell or rent personal information.
• We do not knowingly collect data from children under 13.

2. How we use information

• Operating the service - authenticating you, running and saving queries, connecting to your data sources, and managing workspace membership.
• Security - rate limiting, credential encryption, abuse prevention, and protecting your connected databases.
• Improving the product - analyzing aggregated usage, such as how often AI features are used, to guide what we build next.
• Transactional email - workspace invitations and password resets, sent through our email provider.
• Complying with law when legally required.

We do not use your data for advertising, and we won’t use it for materially new purposes without telling you first.

3. Third parties

We share personal information only with the providers below.

Provider	Role	What they touch
Cloudflare	Hosting, database, caching, AI inference, rate limiting	Everything needed to run the service; the content you submit to AI features
Resend	Transactional email delivery	Recipient email addresses for invitations and password resets

We may also disclose data to comply with law or legal process, or to protect rights, safety, or property.

4. How long we keep data

• Account data - while your account is active, and for a short period after closure.
• Saved queries, charts, dashboards - until you or your workspace owner delete them.
• Connection credentials - until you remove the data source.
• Cached results - until the cache entry expires or you delete the query.
• Password-reset tokens - a short, fixed window, or until used.
• Service logs - for a limited period set by our hosting provider.

5. Your rights

Where GDPR applies (EU/EEA), you can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to certain processing or complain to your local data protection authority. Where California law applies, you can request access, deletion, and correction, and you are free from discrimination for doing so. We do not “sell” or “share” personal information as those terms are defined by the CPRA.

To exercise any right, email privacy@dashql.dev from your account email. We respond within 30 days. For data held on behalf of your organization, we may route the request to the administrator who controls the data source.

6. Cookies and tracking

The service uses no advertising or third-party analytics cookies. We use browser local storage - not cookies - to keep you signed in, which is strictly necessary for the service to work. Clearing your local storage or signing out removes it.

7. Security

Passwords are stored as salted hashes. Data source credentials are encrypted at rest with AES-GCM and per-record initialization vectors, with decryption keys kept outside the database. All traffic travels over HTTPS/TLS. Access to saved queries is scoped per user, and public shares use unguessable links you can revoke. No system is perfectly secure; if a breach ever affects your data, we will notify you without undue delay, and no later than the law requires.

8. Changes to this policy

We post changes on this page and update the date above. For material changes we will give at least 30 days’ notice by email or in-app notice before they take effect.

9. Contact

Privacy inquiries: privacy@dashql.dev.