Privacy Policy

Simple Host (simple-host.app) · last updated 2026-09-01

Simple Host is a static-website hosting service. This policy covers what data it handles, including when the service is used through an integration such as a ChatGPT GPT, an MCP server, or an AI coding agent.

What we collect

• Email address — for sign-in. We collect it when you verify a one-time emailed code, or when Google (more providers later) asserts a verified address. That address is your account username. Signing in on someone else's site (an RSVP, a guestbook — on that site's own domain) creates the same kind of account; the sign-in gates saving, and nothing on the site records who wrote what — we do not email you a key, show you a dashboard, or give that page your API key.
• Provider account id — the provider's stable id for you (Google sub), stored so the same person signing in again is the same account. We also keep a snapshot of the verified email the provider last sent. We do not store your name, picture, or access token.
• Your API key — a random token that authenticates owner requests (deploy, delete, rollback). Stored to look up your account. It is disclosed only after an owner-intent sign-in (emailed code, or “Sign in with Google” on this dashboard). A session cookie on a hosted site is not an API key and cannot deploy or delete anything.
• Sites you deploy — the files you upload, their versions, and the site name. Deployed sites are served publicly on the internet at sites.simple-host.app/<handle>/<site>/. There is no private or password-locked mode — anyone with the address can read a site.
• Per-site state — any data a site saves via the state/collections API. This is public to that site's audience by design; do not put secrets in it.
• Visitor analytics — a count of page loads on hosted sites, taken from the web server's own access log. Details below. Your browser is not tagged for this.
• Basic request metadata — IP address and timestamps, used for rate-limiting and abuse prevention. Raw IPs from API calls are also stored for a limited time (see below).

How we use it

• To authenticate you, host and serve your sites, and operate the per-site backend. One account is used across every site you sign into and every site you own — we can join those in our database. We do not publish that join to other sites' pages.
• To show a site's owner, and this instance's admin, how many people and bots loaded that site.
• To enforce rate limits and quotas and to investigate abuse.
• We do not sell your data or use it for advertising.

Visitor analytics

This section is for people who visit a hosted site — whose loads get counted — not for people deploying one.

When you open a page hosted here, Simple Host counts that visit so the person who published the site can see how many people read it.

The count is taken entirely on the server, from the web server's own access log. Nothing is put on the page you load. There is no analytics script, no beacon, no analytics cookie, and no fingerprint of your browser. Your browser is never touched for this.

The access log line for a request includes the time, which host was asked, the HTTP status, the method, the page path, your IP address, and the User-Agent string. Those log lines are rotated off the server after 30 days.

What we keep in the analytics database is narrower:

• Not your IP address. Each address is hashed (SHA-256, mixed with a secret that stays on the server, then truncated). Only that hash is stored.
• That hash is a lasting identifier. The secret does not change from day to day. The same visitor produces the same hash across days — that is how unique-visitor counts work. Visits can be linked together over time, even though the raw IP is not kept.
• From counted requests we keep: which site, the hour (not the exact second), a classification of person, bot, or our own monitoring, a count of those loads, and the hashed identifier of each distinct visitor in that hour. The page path and User-Agent are read from the log to decide whether the request counts (images, stylesheets, and API calls do not) and which class it is; they are not stored in the analytics tables.
• These analytics rows are deleted after 400 days. If the owner deletes the site, they go with it.

The owner of a site can see view and unique-visitor counts for their own sites. The admin of this Simple Host instance can see those counts for every site on it. Neither is shown your IP address or the hash itself.

A hash of an IP is not a person. People on the same office or home network can look like one visitor; a phone moving between wifi and cellular can look like two.

There is no opt-out of being counted. Blocking cookies or sending a do-not-track header does not change a server log.

Separately from page-view analytics: calls to the API (/v1/…) — including when a hosted page saves data, posts a comment, or submits an RSVP — record the raw caller IP, so abuse can be investigated. Those IPs are kept for 30 days. A country/city/organization lookup for each IP is requested from ip-api.com (the IP only, no request data) and cached with no expiry. Only this instance's admin can see that table. Loading a static page is not an API call and is not stored there.

Using Simple Host through a GPT or agent

When you use Simple Host through a shared ChatGPT GPT or agent, requests are made with the API key configured in that integration. Anything deployed is public and belongs to the account whose key is used. Sites and their data are public to anyone with the link.

Retention & your choices

• You can delete any site you own at any time (via the API or the dashboard); deletions remove the served content and that site's analytics rows.
• Uploaded versions are retained to enable rollback until the site is deleted.
• Visitor-analytics rows are kept for 400 days. Raw IPs from API calls are kept for 30 days. There is no self-serve way to un-count a visit.
• To delete your account or data, contact us below.

Third parties

We use an email provider to send sign-in codes, Google when you choose that button (Google sees that you signed in here; more providers later), and a hosting provider to run the service. The optional "Create with AI" feature sends your prompt (and any attachments) to xAI's Grok to generate a site. API caller IPs are sent to ip-api.com for a country/city lookup (the IP only). No other third-party sharing.

Contact

Questions or data requests: vineetu@gmail.com.