# Privacy at Arrakis

Last updated October 14, 2026.

## Who we are

Arrakis is run by Good AI Labs. This policy covers arrakis.goodailabs.com, the console, the API, the command-line tool and the MCP server: everything that runs on this site's address.

## What we collect

- **Your account.** Your email address, and a password that our sign-in service (Amazon Cognito) keeps; Arrakis never stores it. If you sign in with GitHub or Google, we receive your account ID there and an email address it has verified. Nothing else from those accounts: no repositories, contacts or files.
- **Payments.** Stripe takes card, Link and Apple Pay payments, and we never see your card number. We keep the amount, its status, Stripe's receipt link and a label such as “Visa ending 4242”.
- **Using Arrakis.** The machines you rent, how long they ran and what they cost; the SSH public keys, templates and volumes you add; and your API tokens, which we store only as one-way hashes.
- **Security.** The address each request comes from, counted for rate limits and deleted within hours, and server logs, kept for 30 days.
- **This website.** No ads, no analytics and no tracking cookies. The console keeps your session and your theme in your browser's own storage.

## How we use it

To run your account: sign you in, rent and stop machines, keep your balance and bill each hour. To keep Arrakis secure and stop abuse. To answer you when you write. We don't sell your data, and we don't use it for advertising.

## Who we share it with

- **Amazon Web Services**, where Arrakis runs and stores its data, in the United States.
- **Stripe**, which takes your payments.
- **GitHub or Google**, only if you choose to sign in with them.
- **The infrastructure partners that host the GPUs you rent.** They receive what a machine needs to run, such as your SSH public key and the image you chose, not your email or payment details.
- **Anyone the law requires us to**, and only what it requires.

## How long we keep it

Your account data, for as long as your account is open. Payment and billing records, for as long as tax and accounting law requires. Rate-limit records, for a few hours. Server logs, for 30 days.

## Your choices

You can see, correct, export or delete your data: contact Good AI Labs through [goodailabs.com](https://goodailabs.com) from the email on your account. Signing out ends your session, and you can revoke any API token in the console at any time.

## Security

Everything travels over HTTPS. Tokens are stored as hashes, carry only the permissions you give them and can be revoked at once. Balances only grow on confirmed payments. More in our [security notes](/docs/security).

## Children

Arrakis is for developers and companies. It isn't meant for anyone under 16.

## Changes

When this policy changes, so does the date at the top of this page.