Privacy policy

Last updated November 9, 2026

Heaven is cloud infrastructure provided by Open Mesa. This policy explains how we handle personal information when you visit Heaven, sign in, or use its Computers, pools and related services. Questions and privacy requests go to contact@heaven.dev.

Information we process

• Account and sign-in information. Your email address, account identifiers, authentication records, and the name or profile picture supplied by a sign-in provider. Supabase processes authentication for Heaven. Google and GitHub also process your sign-in under their own policies.
• Service information and content. Your Computers, files, configurations, snapshots and backups; organizations, memberships, permissions and keys; and information you send to support. The services you run on a Computer can collect their own information, which you control.
• Billing information. Contact details, purchases, invoices and payment status. When payments are enabled, Stripe processes payment details; Heaven receives the billing records needed to manage your service.
• Operational and security records. IP addresses, access times, request and connection metadata, resource usage, and records of account and infrastructure actions.
• Analytics. When you open heaven.dev's front page, docs, these policies or the dashboard, PostHog records the page, the page that linked to it, your browser and device type, your country and city, how the page loaded, how far you scrolled, where you clicked, errors on the page, and a recording of the visit. Everything you type is hidden from the recording. On the dashboard, the recording and clicks keep no text, so your Computers, keys and bills are not recorded; there PostHog knows you by your account ID and email address, with your account's kind and age and how much capacity and how many pools it holds. Elsewhere it knows you only as a visitor, by a hash of the day, your IP address and your browser, which changes each day. When you join the waitlist, Heaven tells PostHog that this visitor joined, but not your email address. When you sign in or open the dashboard, Heaven tells PostHog that you signed in and how, and links that day's visits from the same IP address and browser to your account. When a program reads any of heaven.dev's pages without running their scripts, such as a search engine's crawler or an AI agent reading a page's Markdown or llms.txt, Heaven sends PostHog the page, the page that linked to it, the program's user agent and whether the page was found, and counts the program the same way. When you run a Heaven command, from the heaven program, the API, MCP or the dashboard, Heaven sends PostHog the command's name, whether it worked and how long it took, with your Heaven user ID, but never what you gave the command or anything on your Computers. Your browser sends this to heaven.dev, which passes it on to PostHog with your IP address so PostHog can find your country and city. PostHog does not store your IP address. The sign-in and pages that hand out access load no analytics script; when you open one, Heaven tells PostHog which page it was, but never a code or link in its address, and tells it each step of signing in, such as a code requested or refused.

Google sign-in data

Google sign-in requests your basic profile and email address. This includes your Google account identifier, email address, and the name and profile picture Google supplies. It does not request access to Gmail messages, Google Drive files, Calendar events or contacts.

We use Google sign-in data to identify you, associate your sign-in with your Heaven account, establish and protect your session, and provide account support. It is processed by Supabase for authentication and by Heaven for account and access management. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models.

You can revoke Google's authorization in your Google Account connections. Revoking authorization prevents future authorized access; it does not itself delete your Heaven account or information already stored for that account.

How we use information

We use information to operate the service you request: authenticate users, enforce permissions, run and restore Computers, measure usage, manage billing, deliver service notices, answer support requests, investigate failures, and prevent abuse. Your decision to run an AI agent on a Computer does not give Heaven permission to train models on your Google profile or your workload content.

When information is shared

Service providers receive information needed for their functions, including authentication, databases, hosting, networking, backups, payment processing and service communications. Supabase handles authentication, PlanetScale hosts the control-plane database, PostHog receives analytics, and Stripe handles payments when used. Providers may process information in countries different from yours.

Your sharing choices also matter: organization administrators and people you grant access can see the information their role permits. Publishing a website or other service makes its content available as you configure it. Before a private Computer website receives your Heaven identity, Heaven asks for consent where required by its access flow.

We may disclose information when required by law, to investigate abuse or security incidents, or to protect users and the service.

Cookies and security

Heaven uses cookies for sign-in, authorization and sessions. Website analytics stores nothing in your browser. Sign-in providers may use their own cookies. We use access controls and encrypted connections to protect information. No service can guarantee that information will never be lost or accessed without authorization.

Retention and deletion

We retain account and service information while needed to operate your account, meet legal and accounting obligations, resolve disputes, and protect the service. Operational logs and backups have their own retention cycles and may outlast deletion from active systems. Deletion does not promise immediate erasure from every backup.

You can request account deletion through Heaven's account deletion command, or contact us at contact@heaven.dev for access, correction or deletion requests. We may need to verify your identity. Deleting your account can delete its Computers and data; review the confirmation before proceeding.

Changes and contact

We publish changes here and update the date above. Contact contact@heaven.dev with questions about this policy or your information.