Privacy policy

Last updated September 27, 2026

We do not sell your data or use the contents of your machines to train models.

Collaborators Inc. (“we”, “us”) operates cube.computer, the Cube desktop application, and the cloud machines we run on your behalf (together, the “Service”). This page explains what we collect and why.

What we collect

We collect the following information to provide and improve the Service.

• Account data. When you sign in through GitHub we receive your username, email address, and the account identifier. We do not receive your GitHub password.
• Billing data. Stripe processes your payment and tells us your billing status and the last four digits and brand of your card. For starter-credit eligibility, Stripe also supplies a card fingerprint, an identifier used to recognize a card that has already claimed credit. We never see or store your full card number.
• Usage data. How the app and site are used — pages and features opened, approximate location from IP, device and version. We use this to find faults and decide what to build.
• Machine data. The metadata we need to run a machine for you: its size, region, status, and when it ran.
• Correspondence. What you send us when you get in touch.

What is on your machine

Your machine holds whatever you and your agents put there — source code, credentials, tokens, and output. It is stored on infrastructure we operate.

We do not read it. We access the contents of a machine only where it is necessary to keep the Service running, where you have asked us to look at something, or where the law requires it. It is not used to train models and it is not shared with anyone except the providers below, who process it only to run the machine.

Treat a machine as a working environment rather than a vault. Prefer short-lived tokens over long-lived ones, and keep your own backups.

Service providers

We use these companies to run the Service. Each processes data on our instructions.

• Fly.io — runs the cloud machines and stores their filesystems.
• Supabase — accounts, billing state, machine records.
• Stripe — payments and billing management.
• GitHub — sign-in, and access to the repositories you connect.
• Resend — email we send you.
• Netlify — hosts this website.
• PostHog — product analytics for the application.
• Google — measures which of our Google ads lead to a download.

These providers operate in the United States and elsewhere. Where data leaves the UK or the European Economic Area we rely on the transfer mechanisms available to us, including standard contractual clauses.

Legal basis for processing

Where UK or EU data protection law applies, we process your data to perform our contract with you (running the Service and billing for it), for our legitimate interests in keeping it secure and improving it, and to meet legal obligations such as keeping financial records.

How long we keep it

Retention depends on the type of data.

• Account and billing records: while you have an account, then as long as tax and accounting law requires.
• Machines and their contents: kept for as long as you have an account, including while a Machine is paused, so you can return to your work. We do not delete them on a schedule. They are deleted when you ask us to delete the Machine or the account.
• Usage data: up to twenty-four months.
• Correspondence: up to twenty-four months after the exchange ends.

Your rights

Depending on where you live you may ask us for a copy of your data, to correct or delete it, to limit or object to how we use it, or to receive it in a portable form. If you are in California you may ask what we collect and ask us to delete it; we do not sell personal information or share it for cross-context behavioral advertising.

Write to hi@cube.computer and we will respond within the time the law allows. You may also complain to your data protection authority.

Cookies and analytics

The website uses Google's tag to measure whether our Google ads lead to downloads: when you arrive from one of our ads and then download Cube, Google records that the ad led to a download. It may store an identifier on your device for this. In the UK, the EEA and Switzerland it runs without advertising cookies. The application uses PostHog to understand how features are used; this involves an identifier stored on your device.

Security

Traffic is encrypted in transit. Access to production systems is limited to people who need it. No system is perfectly secure, and we do not claim otherwise; if a breach affects you we will tell you as the law requires.

Children

The Service is not for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

Changes

We will update this page when our practices change, and revise the date at the top. Where a change is material we will give notice.

Contact

Collaborators Inc., 8 The Green, Suite R, Dover, DE 19901, United States — hi@cube.computer.