Privacy

Who we are

Arrakis is run by Good AI Labs. This policy covers arrakis.goodailabs.com, the console, the API, the command-line tool and the MCP server: everything that runs on this site's address. Our terms of service cover using Arrakis.

What we collect

• Your account. Your email address, and a password that our sign-in service (Amazon Cognito) keeps; Arrakis never stores it. If you sign in with GitHub or Google, we receive your account ID there and an email address it has verified. Nothing else from those accounts: no repositories, contacts or files.
• Payments. Stripe takes card, Link and Apple Pay payments, and we never see your card number. We keep the amount, its status, Stripe's receipt link and a label such as “Visa ending 4242”.
• Using Arrakis. The machines you rent, how long they ran and what they cost; the SSH public keys, images and volumes you add; a private image's registry login, which we keep encrypted and use only to pull that image; your API tokens, which we store only as one-way hashes; and the steps you take, such as signing up, adding funds, trying to rent and calling the API or the MCP tools, logged with your account's ID.
• Security. The address each request comes from, counted for rate limits and deleted within hours. Our server logs leave your address out.
• This website. No ads. Our server notes each page it serves: the page, the site you came from, any campaign tags in the link, and the kind of browser or crawler, with a code in place of your address that changes every day. Analytics, below, records more. The console keeps your session and your theme in your browser's own storage.

Analytics

We use PostHog, an analytics service, to learn how people find Arrakis and where they get stuck. It records the pages you visit, the site and campaign that sent you, your browser and device, your country (worked out from your browser's time zone; PostHog doesn't keep your address), what you click, how far you scroll, and recordings of your visit.

Recordings never include what you type. In the console they also hide every word on the screen, so your logins, tokens and balance are never recorded. Sign-in codes and tokens are cut out of web addresses before anything is sent.

Once you sign in, your visits are joined to your account's ID, together with the steps you take in your account, such as signing up, adding funds and renting. PostHog never receives your email, your name or your payment details.

Analytics uses a cookie and your browser's storage, except where the law asks for your consent first: the European Union and the European Economic Area, the United Kingdom, Switzerland, Turkey, Brazil, Canada, India, China, South Korea and South Africa, judged from your browser's time zone. There, your visits are only counted, without cookies, until you allow them. If your browser sends Global Privacy Control or Do Not Track, your visits are only ever counted that way. PostHog counts each one with a code made from your address and browser that changes every day.

How we use it

To run your account: sign you in, rent and stop machines, keep your balance and bill each hour. To keep Arrakis secure and stop abuse. To answer you when you write. We don't sell your data, and we don't use it for advertising.

Who we share it with

• Amazon Web Services, where Arrakis runs and stores its data, in the United States.
• Stripe, which takes your payments.
• PostHog, our analytics service, in the United States.
• GitHub or Google, only if you choose to sign in with them.
• The infrastructure partners that host the GPUs you rent. They receive what a machine needs to run, such as your SSH public key, the image you chose and, for a private image, the login that pulls it; not your email or payment details.
• Whoever reports abuse from a machine you rent, such as its host, a network or an authority: what they need to deal with the report, which can include your account's details.
• Anyone the law requires us to, and only what it requires.

How long we keep it

Your account data, for as long as your account is open. Payment and billing records, for as long as tax and accounting law requires. Rate-limit records, for a few hours. Server logs, with the page views and steps above, for 13 months. Analytics, for a year, and recordings of visits for 30 days.

Your choices

You can see, correct, export or delete your data: write to arrakis@goodailabs.com from the email on your account. Signing out ends your session, and you can revoke any API token in the console at any time. Analytics on this browser is yours to change under Analytics.

Security

Everything travels over HTTPS. Tokens are stored as hashes, carry only the permissions you give them and can be revoked at once. Balances only grow on confirmed payments. More in our security notes.

Children

Arrakis is for developers and companies, and you must be 18 or older to use it. We don't knowingly keep data about anyone younger.

Changes

When this policy changes, so does the date at the top of this page. If a translation of this policy differs from the English, the English applies.