Privacy

Startup OS is operated by Maps & Apps Inc. This page describes what we collect through this website, invite requests, the dashboard, and billing, and what we do with it.

Invite requests and invites

If you request an invite on the homepage, we store the email address you submit and the date you submitted it. We use it to contact you about an invite and to send occasional updates about Startup OS.

When we create an invite, we store a hashed form of its single-use code, a note about who it is for, who created it, and when it expires. Once it is used, we also store who redeemed it and when.

The dashboard

If you sign in to the dashboard with GitHub, we store your GitHub account's numeric ID, username, display name, and avatar address. We do not store your email address or any GitHub password or token. When you sign in, or merge a platform update from the dashboard, GitHub issues a token that is used for that one action and then discarded.

We also store what you create and connect there: workspace names, the GitHub organizations you connect, the repositories Startup OS finds in them, and the progress of each onboarding and each proposed change, including links to its pull request. We record when we last checked an onboarding's progress, and when the GitHub App was uninstalled from an organization.

Your model credential is not in our database either. You add it as a secret in your own repository, and we never receive its value. Your business itself lives in the Operations Instance, a repository in your own GitHub organization: goals, decisions, evidence, and configuration are kept there, not in our database.

So that the dashboard opens quickly, we keep a copy of the last summary the GitHub App read from that repository: each product's status, any pending platform update, the business overview, the growth summary, the decisions waiting for you, and the summaries of your weekly, monthly and quarterly reviews. The copy is replaced when the repository changes or when it is a few minutes old, and the repository always wins. It is never used to make or approve a decision.

Billing

Payment is handled by Stripe. Checkout is a Stripe page, and your card details go to Stripe and never reach us. When you first purchase software, we give Stripe your workspace's name so it can create a billing customer for it.

We store the Stripe customer, checkout session, and payment identifiers; your purchased allowance, payment status, price, taxes, and accepted terms version. We do not store card details. Historical subscription records remain in the database migration history.

Implementation inquiries store your name, email, optional product URL, team size, purchase status, areas where you want help, and optional agent environment. Do not submit credentials or sensitive documents through that form.

The GitHub App

Connecting an organization installs the Startup OS GitHub App. You choose which repositories it can reach, and GitHub shows you its exact permissions before you install it. On those repositories it can read and write contents, pull requests, issues, workflows, and checks, and start and read GitHub Actions runs. It can create repositories, which is how it creates your private operations repository, and it can see which Actions secrets exist, though GitHub never shows any app a secret's value. That is what it needs to set up your Operations Instance, open the pull requests Startup OS proposes, and start the first run you ask for. Uninstalling the app from your organization ends its access immediately.

Cookies and analytics

The dashboard sets a cookie that keeps you signed in for up to 30 days. It also sets short-lived cookies, lasting 30 minutes at most, that protect sign-in, organization connection, and platform updates from forgery, and that carry an invite through sign-in. The site stores your theme choice in your browser. None of these track you.

We use Simple Analytics to count visits to the website. It does not set cookies, does not collect personal data, and does not follow you across other websites. We do not use advertising or tracking cookies, so there is nothing for a consent banner to ask you about.

Who processes it

Everything we store is held on Cloudflare infrastructure. GitHub handles sign-in and runs the GitHub App on your repositories. Stripe processes payments, issues invoices, and runs the billing portal. Email is sent through Resend. The invite request form is protected by Cloudflare Turnstile, which blocks automated requests, and your IP address is sent to Cloudflare as part of that check. Visit counts are processed by Simple Analytics.

We do not sell your information or share it with third parties for their own marketing.

Deleting your data

You can delete your account yourself from your account page. That deletes your account, your sessions, and each workspace where you are the only member, with its products, onboarding history, connections, and billing records. In a workspace you share, only your membership is removed. Invite records are kept, with the link to your account removed.

Those dashboard copies are also deleted when the GitHub App is uninstalled from an organization.

Our database keeps a restorable history of the last 30 days, so a record you delete can stay in that history for up to 30 days before it is gone for good. We use it only to recover from a fault.

Deletion also deletes your billing customer at Stripe. Stripe keeps your past payment records and invoices, as tax and accounting rules require.

Nothing in your GitHub is deleted. Your repositories, including your operations repository, stay as they are. The leaving guide lists what to remove yourself.

Your invite request address is kept separately from your account. Write to us and we will delete it.

Contact

Questions about this page can go to hello@mapsnapps.org.

Last updated 21 October 2026.