Privacy Policy

Account information. Your name, email address and, if you sign in with Google, your profile photo. Passwords are handled by our authentication provider and are never visible to us.

Workspace data. Organization names, team members and roles, registered apps (package names, bundle identifiers, runtime versions), channels, release metadata (version, notes, checksums, rollout settings), API key metadata (only a hash of each key), webhook settings, notifications and audit logs of actions taken in your workspace.

Google / Firebase connection data. When you connect a Firebase project, the email of the Google account you authorized, the list of Firebase projects it can access, project identifiers and storage bucket names, and an OAuth refresh token.

Device telemetry from apps using the SDK. A random installation identifier generated on the device, platform, app/native/runtime versions, the installed release and update events (checked, downloaded, installed, failed, rolled back). The SDK does not collect names, emails, phone numbers, advertising IDs, location or the content of the app.

Technical data. IP addresses and request metadata, used for security, abuse prevention and rate limiting.

• To provide the service: authenticate you, run your workspace, store and publish releases, and decide which devices receive an update.
• To operate on your Firebase project at your request: upload, verify and delete update packages in your Cloud Storage bucket.
• To show you analytics about update adoption and failures, and to pause releases automatically when failure rates are high.
• To secure the service: enforce permissions, keep audit logs, detect abuse and rate-limit requests.
• To send service emails such as account confirmation and password resets.

When you connect a Firebase project we request access to your Google account's Firebase and Google Cloud resources. We use this access only to list your Firebase projects, verify Cloud Storage access, and upload, read and delete FireOTA update packages (under the fireota/ folder) in the bucket you choose — and only when you or your team act in FireOTA.

FireOTA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not allow humans to read it except with your permission, for security purposes, or where required by law.

OAuth refresh tokens are encrypted at rest with authenticated encryption and are never shown in the dashboard, logs or API responses. You can revoke access at any time from your Google Account's security settings.

Update packages (your JavaScript bundles and assets) are stored in your own Firebase Cloud Storage bucket, not on FireOTA servers. Devices download them directly from Google.

Everything else is stored in our database hosted by Supabase, with row-level security isolating each organization. The application is hosted on Vercel. These providers process data on our behalf under their own security and privacy commitments.

• We do not sell personal information or share it for advertising.
• We share data with service providers that run FireOTA (Supabase, Vercel, Google) only as needed to provide the service.
• Webhooks you configure send release events to endpoints you choose.
• We may disclose information if required by law or to protect the security of the service and its users.

We keep workspace data while your account is active. Rate-limit records are deleted after one day and unused OAuth sign-in states after ten minutes. Audit logs are kept for the life of the workspace so actions remain traceable.

Disconnecting a Firebase project stops FireOTA from using it; your bucket and its files stay yours. You can ask us to delete your account and workspace data via our GitHub issue tracker.

We use HTTPS everywhere, role-based permissions enforced on the server, tenant isolation in the database, hashed API keys, encrypted credentials, signed webhooks, checksum-verified updates and audit logging. No system is perfectly secure, but we work to protect your data and will notify affected customers of a breach as required by law.

If you integrate the SDK, you are responsible for telling your app's users about the device telemetry described above in your own privacy policy and store data-safety declarations. The SDK sends only update-related, pseudonymous data.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to certain processing. You can update your profile in the dashboard, and make any other request via our GitHub issue tracker.

FireOTA is a tool for software developers and is not directed at children under 16. We do not knowingly collect their personal data.

We may update this policy; the "last updated" date above shows the latest version, and significant changes will be announced in the dashboard. Questions: our GitHub issue tracker.