lemon

Privacy notice

What we hold, why, and what you can do about it. Short on purpose — a longer version is with counsel; this one is accurate today.

Who we are

lemon is a marketplace: independent operators lend machines, developers deploy to them. We are the controller for your account, billing and marketplace activity. For whatever your own application processes while it runs, you are the controller and we are the processor.

What we hold

Data	Why
Email address	It is your account identifier — sign-in, billing, recovery
Password	Stored only as an scrypt hash. We never hold the password itself
Sessions & API keys	Stored only as SHA-256 digests. A copy of our database contains nothing usable as a credential
What you deploy	App name, version, digest, source reference, declared requirements — to place the workload and prove the artifact is what it claims
Usage & billing	Capacity-seconds per app and node, ledger entries, spending caps
If you lend hardware	Node address, hardware measurements, observed uptime, your offers
Recent app output	A rolling ring of the last 200 log lines per app, so support can help after a crash
Messages you send us	The contact form and any abuse report

What we do not do

No card numbers. Payment details go to our processor; we hold a token.
No IP logging. Your address is used briefly to rate-limit public forms and is never stored.
No tracking, no advertising, no analytics cookies, no third-party scripts. We do not profile you, and we do not sell or share data for advertising.
We do not mine what you deploy. No analytics, no model training, no insight sold from your workloads.

Who else sees it

Node operators are independent third parties. When your workload is placed, an operator's machine runs your code: they see resource usage, they do not get your account details, and they cannot read your application logs. Beyond them, only our payment processor, our hosting provider, and a certificate authority for TLS. We disclose to authorities only where legally compelled.

Said plainly: we can read the recent-output ring — that is how support helps you after a crash, and we would rather say so than imply otherwise. The operator hosting your app cannot. Do not print secrets to stdout, which is the same advice every hosted platform gives.

How long

Account — until you delete it.
Sessions — 90 days of inactivity. Password-reset links 1 hour; verification links 24 hours.
App output ring — rolling, 200 lines per app, oldest dropped.
Financial records — kept as accounting law requires, pseudonymised when you delete your account.

Your rights

Get a copy — GET /my/export returns everything we hold about you, immediately. It never contains credentials.
Erasure — DELETE /account. Operational data is deleted. Financial records are pseudonymised: your email is replaced by a one-way surrogate so the accounts still reconcile but no longer identify you.
Correction, objection, restriction — ask us.
Complain — to your national supervisory authority. In Spain that is the AEPD.

One honest limitation. Your email address is the account key throughout lemon. We cannot remove it from records we are legally required to keep, so we pseudonymise those instead. If you would rather not use your real address as an identifier, sign up with an alias.

Contact

Use the contact form — it reaches us directly and needs no account. Please say "privacy" in the message so it is routed properly.

Interim notice. A longer policy and a data processing agreement are in preparation and will replace this. Everything stated here is accurate as of today and will be kept in step with what the software does.