Privacy Policy

Effective date: October 25, 2026 · Applies to gardenhosting.cloud and the GardenHosting Admin companion.

GardenHosting is a hosting service operated under the GardenHosting name. This policy explains the information handled when you visit our site, create an account, upload a website, connect a domain or use our administrator companion. Contact: noreply@hosting.soliman.cfd.

Information we handle

• Accounts: your email, name, username, account creation time and verification status. Password accounts store a salted password hash, not your readable password. Sign-in sessions and verification challenges are stored in protected form.
• Google sign-in: Google provides a stable account identifier, verified email address and profile name through the openid, email and profile permissions. We use these to sign you in and identify your account. We do not request access to Gmail, Drive, contacts or your Google password. Google access tokens are used to obtain your identity during sign-in and are not intentionally retained as account records.
• Hosting: saved HTML and website files, plot names, plans, status, custom domain names and ownership-verification records, deployment jobs, usage measurements, limited container logs and activity history. Uploaded website files are publicly accessible when deployed; do not upload private keys, passwords or other confidential information.
• Payments: Stripe customer, checkout, subscription and payment identifiers, payment status, amounts, refund/dispute records and your Seeds ledger. Payment details are submitted directly to Stripe. We do not receive your full card number or CVC. Sandbox transactions are not real payments.
• Security and operations: request information such as IP addresses used for rate limiting or provider security checks, timestamps and administrative access records. Administrator authentication uses an encrypted authenticator secret, hashed recovery codes and a separate session.

How information is used

We use information to authenticate accounts, send verification and recovery emails, provision and serve websites, verify domain ownership, issue certificates, measure resource limits, process purchases, investigate abuse and respond to support or privacy requests. We do not use Google sign-in data to target advertisements or sell that data.

Service providers and public records

Depending on which features are enabled, our providers include Oracle Cloud for infrastructure, Google for sign-in, Cloudflare Turnstile for bot checks, Resend for transactional email, Stripe for payments and Let's Encrypt for certificates. They process information needed for their services under their own policies. Public HTTPS certificates include domain names in public Certificate Transparency logs. Website visitors receive the public content you host. GitHub is used to build/distribute the admin companion; admin credentials and customer databases do not belong in its source repository.

Cookies, local storage and ads

Essential cookies maintain customer and administrator sessions and protect sign-in and verification flows. Your browser may store an advertising preference locally. Optional display ads are disabled until an ad provider is configured. If enabled, ads appear only in designated site/customer-dashboard areas, not on authentication, payment or administrator pages. Advertising scripts may process device and request information and use storage under the provider's policies. Optional ad scripts are loaded only after the required consent flow; you can withdraw your preference using the advertising controls in the site footer. We do not require you to click or watch an ad to renew a free plot.

Access, protection and retention

Authorized administrators can inspect account, hosting, usage and purchase records to operate the service. Authentication secrets are excluded from account listings. We use HTTPS in production, password hashing, access checks and administrator MFA, but no service can guarantee absolute security. Providers may process data in countries different from yours; the initial hosting region is Jeddah, Saudi Arabia.

We retain account and hosting records while needed to provide the service, and payment/security records as needed for accounting, abuse investigation, disputes or applicable obligations. Expired plots are suspended rather than automatically erased. Deleting a plot removes its active saved content through the worker; related activity, billing records and private backup copies may remain until reviewed or rotated. We do not promise a fixed deletion period that our current backup process cannot enforce.

Your choices and requests

You can edit or replace your hosted content, disconnect domains, sign out, reset a customer password and manage enabled subscriptions through the billing portal. You can revoke Google's sign-in authorization through your Google Account; this does not automatically delete your GardenHosting account. Contact noreply@hosting.soliman.cfd for account access, correction, export or deletion requests. We may verify ownership and retain information needed for unresolved transactions, security or legal obligations. Rights and available complaint channels depend on where you live.

Children and changes

The service is not intended for children under 13. If you believe a child has supplied personal information, contact us. We may update this policy as features change and will change the effective date; material changes will be communicated through the service where practical.