Operator details pending
The operator details this page depends on (publisher identity, hosting provider and contact addresses) have not been published yet. This text is a draft for review. It is not indexed by search engines and does not take effect until those details are published.
Who is responsible
The publisher named in the legal notice decides why and how the account, usage and website data described below is processed, and is the controller for it. Contact for privacy questions and data requests: To be provided.
gpuOS (gpuos.si) and cpuOS share one account. Your name, email address, password hash, linked sign-in providers, sessions, workspaces, members, invitations and API-key records are stored once and used by both sites, so a workspace created on one exists on the other. This policy describes what cpuOS processes. The gpuOS privacy policy covers gpuOS, including its billing data and the prompts relayed by its gateway.
The code you submit and the output your worker returns are your data. You decide what to submit and usually act as the controller. The control plane stores them in your workspace on your behalf. No data processing agreement is published on this site yet. Do not submit personal or regulated data to the pilot until data processing terms are agreed at the address above.
What we process and why
Scroll horizontally to see every column.
| Data | What it includes | Why |
|---|---|---|
| Account | Name, email address, a hash of your password if you sign up with email and password, and, if you sign in with GitHub or Google, your profile image URL, the provider account ID and the tokens the provider issues. | Create your account, sign you in and keep it secure. |
| Account emails | Your email address and name, and a single-use link in each message. Only when email is enabled: a message to verify your address after sign-up and a message to reset a password. We send no marketing email. | Confirm your address and let you reset your password. |
| Sessions | Session token, expiry time, IP address and browser user agent. | Keep you signed in and detect misuse. |
| Workspaces and teams | Workspace name and URL slug, members and roles, and invitations: invitee email address, role, expiry and a hash of the invitation token. | Run team workspaces and invitations. |
| API keys and worker tokens | Name, prefix, a hash of the secret, the products the key works with, expiry time, last-used time and revocation time. Secrets are shown once. | Authenticate API calls and workers. |
| Worker data | What the worker reports: node name, hostname, platform, CPU architecture, CPU count, memory, whether Docker is available, worker version and last heartbeat. | Show your workers and decide which worker can take a job. |
| Jobs | Job name, runtime (Python or Node), submitted code, CPU, memory and time limits, status, stdout, stderr, exit code, duration, error message, timestamps, the user or API key that submitted it, a hash of the idempotency key and a fingerprint of the request. | Run the job on your worker, show its result and history, and make retries safe. |
| Usage | For each finished job: workspace, API key, CPU-seconds, memory GB-seconds, duration, status and time. Also a per-minute request counter for each workspace. | Show usage and apply request rate limits. |
| Messages to us | Your email address and what you write. | Answer you. |
We rely on the following legal bases. Performance of our contract with you covers the account, workspace, key, worker, job and usage data and the account emails. Our legitimate interests cover security, abuse prevention, operating the pilot and measuring how the site is used. cpuOS takes no payments and stores no payment details. We do not sell personal data and do not use it for advertising.
Job code and output
The control plane receives the code you submit and the output the worker returns, and stores both in its database as part of the job record, until their deletion deadline passes (see the section on how long we keep data below). The application does not encrypt them, and we can technically read them.
- The control plane sends the code to your worker, which runs it in a restricted Docker container. The worker's host, its Docker daemon and its logs are yours and outside this policy.
- Connecting your own worker does not keep payloads off the hosted service. This is not an air-gapped setup.
- Do not put secrets or personal data in job code or output unless you are allowed to process them on a hosted service.
Analytics and cookies
Google Analytics 4 is active only on the public marketing pages of cpuos.si: the home page, the documentation, the runtimes, the integrations, the guides, the tools, the pages about the .si stack, and the legal notice, privacy policy and terms. It is not loaded on the sign-in, sign-up, password reset, invitation, dashboard and workspace pages or on the API, and moving from a public page to one of them switches measurement off. On the public pages it uses cookies and sends usage data to Google, such as the page address, browser and device details and approximate location. We also send interaction events: clicks on calls to action, playing the founder video and clicks on the link to gpuOS. These events do not contain your email address or job code. Advertising storage, advertising user data and ad personalization are denied.
The analytics notice informs you. It does not collect your consent: on a public page, analytics cookies are set and usage data is sent as soon as the page loads, closing the notice does not change analytics tracking, and no accept or decline choice is offered today. To avoid analytics, block Google Analytics scripts and cookies in your browser or with a tracking-protection extension. The Analytics information link in the footer reopens the notice.
We also set the cookies needed to keep you signed in. They are first-party cookies from our authentication library. Your browser's local storage remembers that you closed the analytics notice. We do not use advertising or social media tracking cookies.
Who receives data
Scroll horizontally to see every column.
| Recipient | Why | Data |
|---|---|---|
| Hosting provider named in the legal notice | Hosts the website, control plane and database. | Everything the service stores. |
| Email delivery provider chosen by the operator | Sends the account emails. Used only when email is enabled. | Your email address, your name and the content of each message, including its single-use link. |
| Website analytics, and sign-in if you choose Google. | Analytics data described above. Name, email address and profile image for sign-in. | |
| GitHub | Sign-in, if you choose GitHub. | Name, email address and profile image. |
| Your workers | Run the jobs you submit. | Job code and limits for your workspace. The worker returns output. |
Providers handle data under their own terms. The control plane runs at the location in the legal notice, which does not mean that all processing stays in the EU: Google, GitHub and the email delivery provider can process data in other countries, and your workers run where you installed them.
How long we keep data
Job code, stdout and stderr are deleted automatically when their deadline passes. The deadline is set when a job reaches a final state (completed, failed or cancelled): the time it ended plus the retention period of the workspace. An admin or owner of each workspace chooses none, 24 hours, 7 days or 30 days, and 7 days applies until they choose. With none, the deadline is one hour after the job ends, and reading a finished job in the dashboard or through the API schedules its deletion at the next sweep. A periodic task sweeps every 5 minutes, so a deletion can lag its deadline by a few minutes.
Shortening the period, including to none, also applies to content already stored: its deadline is brought forward to the new period counted from the end of the job, and with none, content already stored is deleted within one hour at most. Lengthening the period applies only to jobs that end afterwards: content whose deadline is already set is not extended.
The rest of the job record is kept while the workspace exists: its name, status, exit code, duration, resource settings, error message and usage figures, and a one-way hash of the request that lets a retried submission with the same Idempotency-Key return the original job. Cancelling a job stops it but does not delete its record. Revoking an API key or a worker token disables it and keeps its record. Account, workspace and usage data are kept while the account or workspace exists. Expired sessions, verification codes and invitations that were never accepted are deleted automatically by a periodic task.
Your account is shared with gpuOS, so you download your account data and delete your account on gpuOS, in Settings > Your account. The gpuOS privacy policy describes the download and what is deleted. Deleting the account removes it on cpuOS too. Each workspace where you are the only member is deleted with its nodes, API keys, usage history and jobs, code and output included. Workspaces shared with other people stay, and their only owner must hand over ownership first. The download does not include the code or output of cpuOS jobs, which belong to the workspace. There is no button to delete a single job before its deadline: an admin or owner can shorten the retention period of the workspace, or you can ask at To be provided.
Backups. The database is backed up every day. A backup holds account data and the job code and output stored at that time. Backups are kept for 14 days on the server, and any copy stored away from the server expires within 30 days. Content deleted from the live service, whether at its deadline or because an account or workspace was deleted, can therefore remain in a backup for up to 30 days. Backups serve only to recover the service after a failure, and we do not use them to give deleted content back to users. If the service is restored from a backup, job content whose deadline has passed is deleted again by the periodic task.
Your rights
Under data protection law you can ask to access, correct, delete, restrict or export your personal data, and object to processing based on legitimate interests. You can also lodge a complaint with the data protection authority of your country, which in France is the CNIL.
Downloading your account data and deleting your account are self-service on gpuOS, as described above. Send other requests to To be provided. We handle them manually and may ask you to confirm your identity first.
Security
Passwords, API keys and worker tokens are stored as hashes. Connections to the site use HTTPS. No system is perfectly secure, and we do not hold security certifications. Docker containers share the kernel of the worker's host, so run the pilot only with code you trust, on a machine allocated to it.
Changes
We update this policy when our practices change. The date at the top shows the latest revision (2026-10-15).