Full Privacy Policy
Who we are
Project3000 ("we", "us") runs project3000.io and is responsible for the personal data described in this policy. You can reach us at [email protected].
What we collect
Information you give us
- Account details: your username, email address and password. We store your password only as a secure, one-way hash, never in readable form.
- If you sign in with Google: your name, email address, profile picture and Google account ID, which Google shares with us when you allow it.
- Your apps: app names and addresses, each app's package, the project files you upload, and the records we keep while building and running them. This includes status, resource use, and when you confirmed you had a backup and set up your AI tool.
- Where you came from: if you arrive from the "Live on Project3000" badge on someone's app, we count the visit for that app (the app's name and the day only, nothing about you), and if you then create an account, we note which app's badge you came from. The badge itself is loaded from our site, so, like any web request, our servers see the standard technical data described below; we don't use it to follow or identify visitors, and the badge sets no cookies.
- Custom domains: if you connect your own domain to an app, the domain name, the verification code we give you, and the results of our DNS checks.
- Two-factor authentication: the secret key your authenticator app uses (stored encrypted), your backup codes (stored only in a scrambled form that can't be turned back into the codes), and, if you tick "Remember this device", a record of that device (browser and system type, and dates).
- Early-access list: if you join the list before launch, your full name, email address, what describes you best, and, if you choose to tell us, the AI tools you use, what you want to build and how you heard about us. We also note the date, the version of this policy, and, if you came from a "Live on Project3000" badge, which app's badge it was. No account or password is created.
- Agreements: when you accepted these policies and our Terms of Use, and which version you accepted.
- Messages: what you send us by email or through our Telegram support chat.
Payment information
Payments are handled by Paddle (Paddle.com), our reseller and merchant of record. Paddle collects what it needs for the payment and for taxes (such as your name, email address, billing country and postal code) under its own privacy policy. We receive and keep your Paddle customer and subscription IDs and your plan details (for example, how many app slots of each package you have and when your plan renews). We never see or store your full card number.
Information collected automatically
- Technical data: like any website, our servers record your IP address, browser type and the pages you request in server logs. We use these for security and to fix problems.
- Cookies and local storage: a sign-in cookie, and your cookie choices (see section 4).
How we use it
- To provide the Service: create and run your account, deploy and host your apps, and give you support. (Needed to perform our agreement with you.)
- To bill you for paid plans and keep financial records. (Agreement, and our legal duties.)
- To keep the Service safe: prevent abuse, fraud and attacks, and fix problems. (Our legitimate interest in a secure service.)
- To send you emails about the Service: such as security and account notices, and changes to our terms. (Agreement and legitimate interest.)
- To tell you about the launch: if you joined the early-access list, we email you a confirmation and news about Project3000's launch, and use your answers to understand what people want to build. (Your consent, which you can withdraw anytime with the unsubscribe link in every email.)
- To meet legal obligations and handle legal claims.
We don't sell your personal data, we don't use it for advertising, and we don't make automated decisions about you that have legal or similar effects.
Cookies and local storage
Cookies and local storage are small pieces of information saved in your browser. We keep their use to a minimum, and we don't use any analytics, advertising or tracking cookies.
Strictly necessary (always on)
These are needed for the site to work and to keep your account secure, so they don't need your consent:
| Name | Set by | Purpose | Kept for |
|---|---|---|---|
connect.sid | Project3000 | Keeps you signed in and protects the sign-in (including sign-in with Google). Only set when you sign in. | Cookie, up to 30 days |
p3_td | Project3000 | Remembers this device for two-factor authentication, so it skips the code. Only set when you tick "Remember this device". | Cookie, 30 days |
p3-cookie-consent | Project3000 | Remembers your cookie choices. | Local storage, 12 months |
__cf_bm | Cloudflare | Security: helps tell real visitors from automated attacks. Only set if Cloudflare sees suspicious traffic. | Cookie, 30 minutes |
| Turnstile | Cloudflare | Security: checks that a sign-up, sign-in or early-access request comes from a person, not a bot. Runs only on those forms, in a frame from challenges.cloudflare.com, and sets no cookies on project3000.io. | Nothing kept on our site |
Preferences (only with your consent)
These are off until you allow them. If you do, we remember choices you make on this device:
| Name | Set by | Purpose | Kept for |
|---|---|---|---|
p3-animations-paused | Project3000 | Remembers that you paused the moving animations. | Local storage, until you withdraw consent |
p3000_deletion_warning_… | Project3000 | Remembers that you closed an "app will be removed soon" reminder that day. | Local storage, until you withdraw consent |
Your choice
On your first visit we ask what you allow. You can accept or reject everything with one click, or choose. You can change your choice at any time using Cookie settings at the bottom of every page. If you withdraw consent, we remove the preference data from your browser straight away. We ask again after 12 months or when this list changes.
To keep proof of your choice, we store an anonymous record on our server: a random ID, the date, the version of this list and what you chose, linked to your account only if you're signed in. It holds no IP address or browser details, and we delete it after 13 months.
Our fonts are hosted on our own servers, so loading our pages sends nothing to Google or other font services.
Who we share it with
We share personal data only with service providers that help us run Project3000, and only as much as they need:
- Paddle: our reseller and merchant of record. It processes payments, invoices, refunds and taxes, under its own privacy policy.
- Google: sign-in with Google, only if you choose it.
- Cloudflare: delivers and protects our website, so traffic to project3000.io passes through it. It also checks that a sign-up isn't made by a bot (Cloudflare Turnstile).
- Oracle Cloud Infrastructure (Oracle): our cloud hosting provider. Its servers, in Oracle's Jerusalem (Israel) region, store your account and run your apps, and backup copies are kept in Oracle's Frankfurt (Germany) region. Oracle also sends our emails to you (OCI Email Delivery). Oracle provides the infrastructure only and doesn't use your data for its own purposes.
- Telegram: only if you contact us through the Telegram help button.
- Let's Encrypt: only if you connect a custom domain. We send it the domain name to get its security certificate. Like every public certificate, the domain name is then listed in public Certificate Transparency logs.
We may also share data if the law requires it, to protect people's rights, safety or property, or as part of a merger, sale or transfer of our business (in which case this policy still applies to your data).
Where it's processed
Your account and your apps' data are stored in Israel (Oracle's Jerusalem region), and backup copies in Germany (Oracle's Frankfurt region, in the European Union). Israel and the European Union recognise each other's level of data protection. Our other service providers may process data in countries other than your own, including the United States and countries in the European Union. When we transfer data, we rely on the safeguards those providers offer, such as standard contractual clauses, to keep it protected.
How long we keep it
- Account data: for as long as your account exists. Remembered devices are forgotten after 30 days, or sooner if you choose "Forget all remembered devices".
- Early-access list: until you unsubscribe, or until 6 months after launch at the latest. The unsubscribe link in every email deletes your details from the list right away.
- App downloads (exports): a ZIP you create with the Download button is kept for 5 minutes so you can download it, then deleted automatically. A new ZIP replaces the previous one. Only you can download it.
- Custom domains: until you remove the domain or the app. Public certificate logs are kept by others and can't be deleted.
- App files and data: until the app is removed (see "Your projects and backups" in our Terms of Use).
- Disaster-recovery backups: the Service's database can be restored to any moment in the last 7 days, and nightly copies are kept for 30 days and then deleted. So anything deleted from the Service is also gone from our backups within 30 days.
- Server logs: for a short time, usually a few weeks.
- Billing records: for as long as tax and accounting laws require (in Israel, generally 7 years), even after your account is closed.
When you ask us to close your account, we remove your personal data within 30 days, except what we must keep by law.
Security
We protect your data with:
- Encryption at rest: everything we store (your account, your apps' files and databases) is on Oracle Cloud Infrastructure storage, which encrypts all data at rest with AES-256, automatically.
- Encryption in transit: connections to Project3000 and to your apps (on *.apps.project3000.io or your own domain) use HTTPS.
- Separation: each app runs in its own isolated environment, with its own database, cache and file storage, so apps can't reach each other's data.
- Two-factor authentication: required for every account. Its secret keys are encrypted, backup codes are stored only as hashes, and wrong codes are limited to stop guessing.
- Limited access: passwords are stored only as secure hashes; our servers and databases aren't reachable from the internet, and administration goes only through a secured, logged access gateway, limited to the people who run the Service.
No system is perfectly secure, so we can't guarantee absolute security. If a data breach puts you at risk, we'll tell you and the authorities as the law requires.
Data in your apps
Your apps' data is yours only. We don't look at it. Project3000 doesn't view, read, copy or use the content of your apps: their code, files, databases and the information your app's visitors enter. Our systems only handle it automatically, to store, build, run and back up your app. The only exceptions are:
- when you ask us for help and give us permission to look, and only for that request;
- when we need to investigate a security problem or a breach of our Terms of Use (for example abuse or illegal content), and only as much as needed;
- when the law or a court requires it.
We never sell your apps' data or use it for advertising or to train AI.
If an app you deploy collects information from its visitors, you are responsible for that data, including telling your visitors how you use it. We only store and run it to host your app, following your instructions, and we don't use it for anything else.
Your rights
Depending on where you live (including under the Israeli Privacy Protection Law and the EU General Data Protection Regulation), you have the right to:
- see the personal data we hold about you, and get a copy of it;
- have it corrected if it's wrong;
- have it removed, or ask us to limit how we use it;
- object to how we use it, and withdraw consent at any time (for example, for the launch email);
- complain to a data protection authority, such as the Israeli Privacy Protection Authority or the authority in your country.
To use any of these rights, email [email protected]. We'll reply within 30 days and may ask you to confirm your identity first.
Age limit
Project3000 is only for people aged 18 and over. We don't knowingly collect data from anyone younger. If you think a minor has given us their data, contact us and we'll remove it.
Changes to this policy
We may update this policy. The date at the top shows the latest version. If we make important changes, we'll tell you by email or on the site, and we'll ask you to accept them before you continue using your account.
Contact
Questions or requests about your privacy? Contact Project3000 support at [email protected], or use the Telegram help button on any page.