Privacy Policy

1. Who We Are

RunCabin ("we", "us", "our") is an AI-agent-enabled website platform operated by Ryan Mergen, based in Baltimore, MD. We can be reached at hello@runcabin.com.

2. Information We Collect

When you use the AI builder, publish a Cabin, or otherwise interact with the Service we collect:

• Account info - email address and name, and a postal address if you create API keys. When we register a domain for you, the registration carries RunCabin's own contact details, not yours (see Terms §3.4); what we keep about you when you buy one is under "Domain purchases" below.
• Build conversations - the messages you exchange with our AI builder ("Cobble"), uploaded images, and the resulting generated pages. We store these so you can come back to your draft and so we can debug failed builds.
• Website planner answers - when you use our website planner (/spec/), your answers, notes, contact details and uploaded photos are saved as you enter them, even before you check out, so you won't lose them and Ryan can help if you get stuck. Typing an email address there does not create an account; that happens only at checkout.
• Cabin contents - the pages, images, schema, and data you publish on your Cabin. This lives in your Cabin's container and a corresponding Postgres schema.
• Usage records - Cabin token debits, AI API calls made by your Cabin's agent, request timestamps, and approximate model cost. Stored so we can bill accurately and show you a usage breakdown.
• Payment metadata - handled by Stripe. We keep your Stripe customer ID and your payment history (what you paid for, how much and when). Your card number stays with Stripe: we never see or store it.
• Domain purchases - when you buy a domain through us (from our website or through an AI assistant or our API), Stripe's checkout asks for your name, billing address and phone number, and we keep them with the order. When Stripe charges your card it asks your card's bank whether the street address and postal code match the card, and we keep the answer (match, no match, or not checked); we never see the card itself. Why: RunCabin is the registered holder of every domain it buys for you, and the rules registrars work under (ICANN's Registrar Accreditation Agreement, section 3.7.7.3) require the holder to be able to name the person actually using a domain and give their contact details within seven days to someone who shows reasonable evidence that the domain is being used to harm them. We also use the address check to spot fraudulent purchases. We do not send these details to the registrar or publish them in the domain's public registration record, and we share them only as those rules or the law require.
• Sites you publish through an AI assistant or our API - the pages and files you or your assistant publish (including files fetched from web addresses you give), the domain names you check or connect, the address you ask us to forward a domain's email to, and feedback you or your assistant send us. See Section 9.
• Your visitors' data - what visitors type into forms on sites we host, a log of visits to those sites, and, on a site with member sign-in, its members' email addresses and sign-ins. See Section 10.

3. How We Use Your Information

We use the information described above to:

• Operate the AI builder and your published Cabin;
• Bill monthly publishing fees and debit Cabin tokens for AI usage;
• Send transactional emails (publish confirmations, low-balance alerts, payment receipts, support replies);
• Debug failures, improve the platform, and detect abuse;
• Comply with legal obligations (tax records, registrar requirements, lawful requests).

We do not sell your data, and we never share your account data, build conversations, or Cabin contents for marketing. The one exception, limited to our public marketing pages, is a B2B visitor-identification service that recognizes which businesses browse so we can follow up - see section 6.

No AI training. We do not use your data, your visitors' data, or anything an AI assistant sends us or reads through our connector or API to train AI models, and we do not sell or give it to anyone to train theirs. The AI providers in Section 4 receive only what each request needs to produce its result.

4. Sub-processors

We use the following third-party services to deliver the Service. Each is bound by its own privacy policy and processes only the data necessary for its specific function:

• Hetzner (Germany, Finland) - hosting infrastructure for the orchestrator, your Cabin's container, the sites we host, and the underlying Postgres database, in Hetzner's Falkenstein datacenter park (Germany); our off-site backups are stored with Hetzner in Helsinki (Finland).
• DigitalOcean (US) - former hosting provider; remaining copies of data are being decommissioned following our July 2026 migration to Hetzner.
• Anthropic (US) - Claude models. Receives the message contents sent to your Cabin's agent and to Cobble during the design phase, and the text of messages visitors send through forms on sites we host, to screen them for spam before we email them to the site owner.
• OpenAI (US) - used for image generation (gpt-image-2.5). Receives the image prompts you or your Cabin visitors submit.
• Stripe (US) - payment processing for publishing fees, Cabin token top-ups, and domain registration pass-through.
• Porkbun (US) - domain registrar and DNS host, when you check a domain or ask us to register or manage one on your behalf. Receives the domain name and its DNS records. Registrations carry RunCabin's own contact details, never yours.
• ImprovMX (US) - email forwarding, when you set it up for a domain you bought through us. Receives the domain and the address its email is forwarded to, and handles the forwarded mail.
• Resend (US) - outbound transactional email delivery (your publish receipts, low-balance alerts, form messages your visitors send if you asked to get them by email, feedback you send us through an AI assistant, etc.); through a separate account on our runcabin.io domain, our business outreach email (see Section 5); and, through another separate account used only for member sign-in on sites we host, those sites' sign-in codes, invitations and join-request notices (see Section 10).
• GitHub (US) - hosts the private repository containing your Cabin's source code.
• Domain registries and Google Public DNS - receive only the domain names you check or connect, when we look up whether a name is available or where it points.
• Plausible Analytics (EU) - cookieless website analytics for runcabin.com. Receives anonymized page views; no personal data, no cross-site tracking.
• Google (US) - Google sign-in, when you choose "Continue with Google" (Google tells us your email address and name). Google Analytics (GA4) for website & ecommerce analytics and Google Ads for conversion measurement, on our marketing/checkout pages and the AI builder. Sets first-party cookies (e.g. _ga, _gcl_aw) to measure traffic, purchases, and which ads lead to sign-ups.
• Vector (Leadsy) (US) - B2B visitor identification on our public marketing pages. Receives visitor IP and page-visit data to estimate which company is visiting (from publicly available firmographic data) so we can follow up with relevant businesses. Used only on runcabin.com marketing pages, never in the app, your dashboard, or your published Cabin.

5. Email Communications

By creating an account, you agree to receive transactional emails related to your Service: publish confirmations, payment receipts, low-balance and zero-balance alerts, security-relevant notices, and support replies. We do not send marketing newsletters to our customers. If we ever introduce optional marketing email for customers, it will be strictly opt-in.

Business outreach. We also email businesses that have not signed up, business to business. We find them in public licensing records (for example, state lists of licensed care providers and county business licences), which list a business's name, address, phone number and licence details, and often a contact email. For a business that looks like it has no website yet, we build a sample draft website using those public details, and we check with Google Places whether the business already has a website of its own. We then email the address from the licensing record from ryan@runcabin.io, through a separate email account, with a link to the draft. A business gets a short sequence at most: the first email and one follow-up, or a few more if someone opens the draft. Every one of these emails says it is a business solicitation, and has our postal address and a one-click unsubscribe link. An unsubscribe is permanent: that address gets no more outreach or marketing email from RunCabin.

When a draft is opened, our servers log the visit (IP address, time and browser), as they do for any page, and we use that to decide whether to follow up. Sample drafts are taken down automatically after a trial period (a longer one if the business adds its own photos to its draft). To have your business's draft and contact details removed, or to stop these emails, use the unsubscribe link or email hello@runcabin.com.

6. Cookies & Analytics

Our public marketing/checkout pages and the AI builder run Google Analytics (GA4) and Google Ads conversion measurement, plus cookieless Plausible analytics and a B2B visitor-identification pixel (all described below). Your signed-in dashboard and your published Cabin do not load Google Analytics, Google Ads, or any third-party advertising pixel - only the first-party cookies needed to operate the site. Sites we host carry our own first-party visit counter, which sets no cookies (Section 10); a site with member sign-in sets one sign-in cookie for its members (below).

Functional cookies (always on while signed in):

• aibuild_slug - keeps your AI build draft tied to you across page loads. 30-day expiry, HttpOnly, first-party.
• aibuild_dash - signed-in dashboard token for managing your published Cabin. 30-day expiry, HttpOnly, first-party.
• tax_session - sign-in token for tax-services customers (if applicable). HttpOnly, first-party.
• __Host-cabin_member - only on a site we host on its owner's own domain with member sign-in turned on, and only once a member signs in there: keeps that member signed in on that one site. A fixed 30 days (signing out ends it sooner), HttpOnly, set by that domain alone. It holds a random token that we store only as a hash.

These are strictly necessary to keep you signed in and are exempt from consent requirements under GDPR and ePrivacy rules. If you refuse them you will not be able to stay signed in.

Analytics & ad measurement: We use Plausible Analytics (cookieless - no persistent identifiers, no cross-site tracking) alongside Google Analytics (GA4) and Google Ads on our marketing/checkout pages and the AI builder. Google Analytics and Google Ads set first-party cookies (e.g. _ga, _gcl_aw) to measure site usage, purchases, and which ads lead to sign-ups. To opt out of Google Analytics use Google's opt-out browser add-on; manage ad personalization in your Google Ad Settings; or block these cookies in your browser. Plausible remains cookieless and you can opt out of it via our cookie banner.

Business visitor identification (marketing pages only): On our public marketing pages we use Vector (Leadsy), a B2B service that estimates which organization a visitor belongs to from their IP address and publicly available business data, so we can reach out to businesses that may benefit from RunCabin. It identifies companies, not individuals, and runs only on runcabin.com marketing pages. To opt out, email hello@runcabin.com and we will exclude you.

You can re-open the banner at any time by clicking cookie preferences.

7. Data Storage & Retention

Your data is stored on infrastructure operated by the sub-processors listed in Section 4. Our servers, the sites we host and our database are in Hetzner's data centers in Falkenstein, Germany; our off-site backups are with Hetzner in Helsinki, Finland, and a further backup copy is kept on an offline drive we control in the United States. The providers based in the United States (Section 4) process there the data they need for their part. Retention:

• Draft AI builds - retained while your account is active; purged 90 days after last edit if never published.
• Website planner answers - kept so we can follow up and help you finish, whether or not you pay. Photos from an unpaid plan are deleted after 90 days with no activity, and a plan with nothing in it after 2 days. Email hello@runcabin.com to have yours deleted sooner.
• Published Cabin content and database - retained for the life of your subscription, plus 30 days after cancellation for restoration.
• Usage records (Cabin token ledger, AI call logs) - retained for 24 months for billing reconciliation and dispute resolution.
• Stripe billing data - retained as long as legally required for tax and audit purposes.
• Domain purchase details (your name, billing address, phone and the card's address check) - kept for as long as the domain is registered through us, and after that only as long as the registration rules, tax law or an open dispute about the domain require.
• GitHub repository - remains in your possession indefinitely (see Terms §8).
• Sites published through an AI assistant, our API or the AI builder - kept until you delete the site or ask us to. A site on free hosting that first went live on or after November 2, 2026 goes offline 90 days after that day, unless its hosting is paid, and is deleted 30 days after it went offline. Besides the live version, a site keeps the 10 most recent other versions; older versions are deleted, and so is a preview that was never made live, 30 days after it was made. Deleting a site deletes its files, versions, previews, forms, form messages and visit log.
• Temporary sites an AI assistant publishes without an account - deleted 7 days after they are published unless someone keeps them by signing in, with their files, versions and visit log. To limit how many one connection can publish, we store a keyed hash of the publishing IP address, or of the AI app's anonymous user id when the app sends one (never the address or the id itself) with the site until it is kept or deleted.
• Form messages from your visitors - kept until the site is deleted, or sooner if you ask us.
• Members of a site with member sign-in - a member's email address, name, status and sign-in times, and the name and note sent with a request to join, are kept until the site owner removes them or deletes the site. A removed or declined address is deleted 180 days after the removal, and is blocked from signing in or asking again until then. A request to join that nobody answers is deleted after 90 days. A sign-in code (stored only as a hash) works for 10 minutes; a sign-in lasts 30 days. The send log behind our sending limits holds keyed hashes of the address and of the requester's IP address, never the address itself, and is deleted after 48 hours. Deleting the site deletes all of it.
• Visit logs - each visit is deleted once it is older than 13 months, and the whole log is deleted with the site.
• Feedback you send through an AI assistant - deleted after 24 months, or sooner if you ask us.
• AI assistant access (OAuth) - a sign-in code lasts 60 seconds, an access token 1 hour and a refresh token 30 days. The record of a connection (the app, your account email, times, and the tokens, stored only as hashes) is deleted 7 days after its refresh token expires, including when you disconnect the app sooner (disconnecting ends its access at once). An app registration that is never used to sign in is deleted after 30 days.
• Requests to our MCP server - for each request an AI app sends to our MCP server or to the sign-in steps it goes through, we keep the time, which of our addresses it was sent to, the IP address and browser string (user agent) it came from, the name the app gave itself, the account and tool it used, and whether it worked, never what it sent. Deleted after 30 days.
• Your agreement to our Terms of Service - when you tick the box agreeing to our Terms of Service while connecting an AI app, creating an API key or approving a tool's sign-in, we keep your account email, the date of the Terms version you agreed to, when you agreed, where, and the name the app gave itself. We keep it as long as we might need to show what you agreed to, including after your account is closed.
• Backups - data you or we delete can remain in our backups until they expire, at most 120 days later. For their first 30 days our off-site backups cannot be deleted or changed by anyone, including us; this protects them against attacks and mistakes.

8. AI Agent Conversations

When your Cabin's AI agent talks to a visitor, the conversation is sent to the upstream model provider (Anthropic by default) so the model can generate a reply. We keep a record of those calls - token counts, timestamps, and (for debugging) the message content for a limited window - so we can show you usage and investigate failures. If your Cabin asks visitors for personal data, you are the data controller for that data; RunCabin processes it on your behalf.

9. AI Assistant & Connector Access (MCP)

You can connect AI assistants (such as Claude or Muse) and coding agents to your RunCabin account through our MCP connector or API keys. When you do:

• Sign-in and consent - the assistant is authorized via OAuth: you sign in on our own page, which lists what the assistant will be able to do, and approve access before it can act. We never share your password with the assistant. You can disconnect it at any time under Connected apps at runcabin.com/keys, which ends its access at once, or by emailing us.
• What the assistant can do - see your sites, their files and past versions, whether they are up, and their visitor counts (totals, top pages and countries); create sites, publish pages and files to the public web, change or roll back what a live site shows, and stage previews (a preview opens for anyone who has its link); upload files, including files it fetches from a web address you give it; give you a link for adding your own photos from your phone (we remove each photo's location and camera data before it goes on your site, where it is public at its address; anyone with the link can add photos for 72 hours, so keep it to yourself); delete a site, with its form messages and visit log; add contact forms and read the messages your visitors send through them; check domain names and prices, connect a domain to a site, and start a domain or hosting checkout; on a domain you bought through us, add verification (TXT) records and set up email forwarding, which changes the domain's mail records and sends the forwarding address to ImprovMX; set up member sign-in on a site on your own domain, which lets it choose the pages only members can open, add, approve or remove members (it can have us email them an invitation), and read the names and notes people send when they ask to join; and send feedback to our team. It can never charge you by itself: every purchase requires you to review the order and pay on our checkout.
• What we store - the sites, files and versions the assistant publishes for you, the domain names it checks or connects and the orders it starts (with the name, billing address and phone you enter when you pay for a domain, see "Domain purchases" in Section 2), a forwarding address you set up, photos added through a photo link and what the person said each one shows (deleted with the site), the members of a site's members area (Section 10), feedback it sends (with the name the assistant gives itself), and access credentials (stored only as cryptographic hashes - we cannot read them back). We log tool calls and the other requests to our MCP server (the time, the acting account, and the IP address and app they came from) to bill accurately, debug failures, and detect abuse. How long each is kept: Section 7.
• What we do not receive - your conversation with the assistant stays between you and the assistant's provider. We receive only what the assistant sends through our tools: the requests themselves (for example "publish this page"), and feedback when you or the assistant, with your agreement, choose to send it.
• No AI training - nothing an assistant sends us or reads from your account is used to train AI models (Section 3).

10. Visitors to Sites We Host

Every page we host for a site published through an AI assistant, our API or our AI builder includes a small RunCabin visit counter. For each page view it records the page, the time, the visitor's IP address, browser (user agent) and referring page, the screen size, browser language and time zone, whether the browser says it is automated, and campaign tags in the address (such as utm_source or gclid). From the IP address our own servers estimate an approximate location (country, region, city, postal code and coordinates) and the network operator, using a MaxMind GeoLite2 database stored on our servers; the address is not sent to MaxMind or anyone else for this. The counter sets no cookies, and RunCabin adds no third-party analytics or advertising pixel to these sites (a page the site owner writes may add its own).

What visitors type into a form on a site we host is stored with the visitor's IP address and shown to the site owner. If the owner asked to get form messages by email, we screen the message for spam (Anthropic) and email it to them (Resend).

Member sign-in. A site owner can make parts of their site open only to members, on their own domain. Someone who signs in there, or asks to join, gives their email address (and, when asking, a name and a note for the owner). We email them a 6-digit sign-in code, an invitation the owner asked us to send, or a note that they were approved, and we email the owner a notice of each request to join, all through a separate RunCabin account at Resend used only for this; Resend receives the address and the message. We store the address, name, note, status and sign-in times; sign-in codes and sign-ins only as hashes. A signed-in member's browser keeps the __Host-cabin_member cookie for that site (Section 6). How long each is kept: Section 7.

The site owner decides what their site collects and is the controller of their visitors' and members' data; RunCabin processes it on the owner's behalf, shows it only to the owner (and to us, to run and protect the service), and deletes it with the site (Section 7). Site owners are responsible for telling their visitors about it. A visitor who wants their data removed can ask the site owner, or email us at hello@runcabin.com.

11. Your Rights

You have the right to:

• Request a copy of the data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data at any time (subject to records we are legally required to retain; copies in our backups expire as described in Section 7);
• Export your Cabin's content and database, or have your GitHub repository transferred to your own account;
• Disconnect any AI assistant at any time at runcabin.com/keys, and delete a site it published (through the assistant or by asking us).

To exercise any of these rights, email hello@runcabin.com. We will respond within 30 days.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on your dashboard at least 30 days before taking effect. The "Last updated" date at the top of this page always reflects the current version. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact

Questions about this policy? Email us at hello@runcabin.com.