Privacy policy

Last updated 27 October 2026.

edshell (edshell.com, api.edshell.com) runs short-lived virtual machines ("sandboxes") for software and AI agents. This page says what we collect when you use it, why, and how long we keep it.

What we collect

• Your Google account basics, when you sign in with Google: your email address, name and profile picture, and Google's account id. We ask Google for nothing else: no contacts, files, mail or calendar.
• A session cookie that keeps you signed in to the dashboard. It is the only cookie we set; there are no advertising or analytics cookies.
• API keys. We store a one-way hash of each key, its name, a short prefix so you can recognise it, and when it was created and last used. We cannot read a key back after showing it to you once.
• CLI logins. When you run edshell login, we record the device name it sends and the IP address and country of the request, and show them to you before you approve.
• Sandbox records: for each sandbox, its template, size, the metadata labels you attach, and when it started and ended. We use these to run the service, enforce plan limits and calculate usage.
• Request logs (time, path, status, IP address) kept by our hosting providers for operating and securing the service.

What runs inside your sandboxes

The commands, files and network traffic inside a sandbox are yours. We do not inspect, keep or train on them. When a sandbox ends, its virtual machine and disk are destroyed, and nothing in it is kept.

How we use it

Only to provide edshell: to sign you in, run and stop your sandboxes, show your usage, prevent abuse, and contact you about your account or the service. We do not sell your information or share it for advertising.

Who processes it

edshell runs on Cloudflare (website, API and database) and Google Cloud (the machines that run sandboxes). Sign-in goes through Google. These providers process data on our behalf under their own security and privacy terms.

How long we keep it

• Account details: until you ask us to delete your account.
• Sessions: expire 30 days after your last visit. CLI login codes: deleted a day after they expire.
• Revoked API keys and sandbox records: kept with your account, because usage and billing history depend on them.

Your choices

You can revoke API keys and sign out at any time from the dashboard. To get a copy of your data or have your account and its records deleted, email us at the address below.

Contact

Questions or requests: jayaram.linux@gmail.com.

Changes

If we change this policy, we will update this page and the date at the top. If a change is significant, we will tell signed-in users.