Privacy policy
Privacy policy
This page explains what personal data spaceapp.dev, the SpaceApp install telemetry and the Nous app collect, why, who receives it, how long it is kept and what you can ask us to do. Last updated 9 November 2026.
Who we are
- Controller
- INTRATRADE ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (INTRATRADE SINGLE MEMBER P.C.), trading as OLL4
- Address
- Ioanni Diakidi 136, Perivola, 26335 Patras, Greece
- GEMI number
- 180769616000
- VAT
- EL802678365
- Contact
- crew@spaceapp.dev
What this policy covers
The website spaceapp.dev and its documentation, the AI advisor and the forms on it, the SpaceApp waitlist, the optional install telemetry of the SpaceApp launcher, the Nous app, and Google user data for Nous Computer, which is still in development.
It does not cover a SpaceApp you install and run yourself. That SpaceApp runs on your own machine or server and sends us nothing except the install telemetry below, and only if you turn it on. Whoever runs a SpaceApp is responsible for the data in it; each SpaceApp serves its own privacy page at /privacy.html.
Visiting the website
Hosting, Cloudflare and server logs
The site runs on our server, hosted by Hetzner Online GmbH in Germany, behind Cloudflare, which delivers and protects it. Cloudflare handles every request, including your IP address and browser details, and may set cookies it needs for security.
Our web server writes an access log and an error log with your IP address, the time, the page you asked for, the response status, your browser's user agent and the referring page. The logs are rotated by size, up to ten compressed older files are kept, and there is no fixed time limit, so how long a line stays depends on traffic. We use them to run, secure and fix the site.
Google Analytics
The homepage, the documentation and the compare and reviews pages ask in a banner whether you accept Google Analytics 4 (measurement ID G-8CL8MY0ET4). Until you choose Accept, and if you choose Reject, the Google script is not loaded and none of the cookies or analytics storage below is set. Google Consent Mode v2 starts with everything denied; Accept grants analytics storage only, never advertising. We keep your choice in your browser, and you can change it at any time with the Cookie settings link at the foot of those pages. This privacy page, the about page and the pilot page do not load Google Analytics. These are stored in your browser:
| Name | Where | Set by | Purpose |
|---|---|---|---|
spaceapp_analytics_consent | Local storage | Our consent banner | Remember whether you chose Accept or Reject |
_ga, _ga_8CL8MY0ET4 | Cookies | Google Analytics, after Accept | Tell visits from the same browser apart |
space_visit_count, space_last_visit_time | Local storage | Our analytics script, after Accept | Count your visits and the days since your last one |
After you accept, it sends Google, with your IP address and browser details: the pages you view and the page that sent you; your operating system, device type, screen size, language, time zone, network type, whether you are new or returning, your visit count and days since your last visit; how far you scroll and how long you stay; the links, buttons, tabs and media you use; copy-button uses; for text you copy from the page, its length and first 50 characters; what you type into a search box; page speed measurements; and script error messages. It does not send what you type into the advisor or the forms.
We use it to see which parts of the site help visitors. We do not use it for advertising. To stop it, open Cookie settings and choose Reject: that deletes the Google Analytics cookies and our visit counts above. Google keeps data already sent for the retention period set in our Analytics property.
Other content from third parties
- When you scroll to the live-stream section of the homepage, it loads a YouTube player from youtube-nocookie.com and YouTube's player script, so Google receives your IP address and browser details.
- When you start the AI advisor or the brief form, the page loads Cloudflare Turnstile, a check that you are a person. Cloudflare receives your IP address and browser signals, and our server sends Cloudflare the check's result token and your IP address to confirm it.
- The demo plays a music stream from freeCodeCamp's Code Radio only if you press play.
The AI advisor
Your question and up to eight earlier turns of the same conversation go to our server, then to our own AI gateway, then to OpenAI, which writes the answer. We do not store the conversation: our logs keep the outcome, timing and size of each request, not its text. OpenAI processes the text under its API terms. To limit abuse we count requests per visitor using a salted hash of the IP address. Do not put personal or confidential information in your questions.
The brief form
When you send a brief, your name, email and message, and the company, role, topic and setup you chose to give, are emailed to crew@spaceapp.dev. That mailbox is on our mail server, and a copy is delivered to a Google Gmail mailbox we use. We use the brief to answer you. We keep it in our mailboxes until we delete it or you ask us to. Requests are rate limited using a salted hash of your IP address; the log line of a request holds its outcome and timing, not what you wrote.
The pilot request
When you ask for a paid pilot, your name, company, team size, email and message are emailed to our founder on our own mail server. We use them to reply and to prepare an offer. We keep them in that mailbox until we delete them or you ask us to; if we sign a contract, we keep contract and invoice records as Greek tax and commercial law requires.
The waitlist
If you joined the SpaceApp waitlist, we store your email address, the time you gave consent, where you signed up and when, in our SpaceApp database on our server. We use it to send you private preview access and launch updates by email, starting with a welcome email. Your IP address is used to limit repeated sign-ups and is not stored with your entry. We keep your entry until you ask us to remove it. Removal is done by hand: reply to any of our emails or write to crew@spaceapp.dev and we delete your entry.
Emailing us
If you write to us, we keep your email and our replies in our mailboxes to answer you and to keep a record of what we agreed.
Install telemetry
The SpaceApp launcher (version 1.1 and later) asks during install whether to send usage telemetry. The default answer is No, and nothing is sent unless you say yes. The SPACEAPP_TELEMETRY environment variable overrides the answer: 0, false, no or off stops it.
If you turn it on, a first install gets a random install ID, and each event carries it with a new random event ID: when the install starts, your operating system and version, CPU architecture, CPU count, memory, the install profile and access mode, and the launcher and SpaceApp versions; when it ends, whether it succeeded, how long it took and the step that failed; from SpaceApp, when the owner account is created, which CLI starts first and when the first answer arrives; and at most once a day when you open SpaceApp, your screen size and pixel ratio, browser family and major version, interface language and SpaceApp version. Our server adds the country Cloudflare derives from your IP address.
Earlier launcher versions, including the 0.1.x prerelease still published under the npm tag personal, sent one install ping by default on a first install, with a random install ID, operating system, CPU architecture, launcher and runtime versions and the install date, unless SPACEAPP_TELEMETRY was 0 or false.
It never sends your files, prompts, answers, models, credentials, paths or accounts. The telemetry record does not hold your IP address, but the request appears in the server logs described above. We use it to see whether installs work and where they fail. We store the records on our servers with no fixed deletion date; to have yours deleted, send us your install ID.
The Nous app
The Nous app for Android connects only to the SpaceApp you pair it with; when that is a SpaceApp you run, your conversations and files stay between your phone and your SpaceApp and do not reach us. Pairing uses a QR code that is valid for two minutes, and the connection is encrypted. The app keeps its device keys in the Android Keystore.
If you turn on notifications, your SpaceApp sends them through Google's Firebase Cloud Messaging, so Google carries each notification's title and a preview of up to 240 characters to your phone.
Nous Computer and Google user data
Nous Computer, a hosted computer that Nous runs for you, is in development and not open to users yet. Before it opens, we will update this policy to describe it in full. It will let you connect your own Google account for the Gemini API, and for that Google user data we commit to the following:
- We will request only the Gemini API access needed to send your own requests to Gemini on your own Google Cloud project, and use it only when you ask Nous for a task.
- We will not read, store or change any other Google data.
- We will keep the access token encrypted for you alone. We will never sell it or the data it gives access to, share it with other users, use it for advertising or use it to train AI models.
- No person will read that data unless you ask us to, it is needed for security, or the law requires it.
- When you disconnect, we revoke the grant and delete the token. You can also remove access at any time at myaccount.google.com/permissions.
SpaceApp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Who receives personal data
- Hetzner Online GmbH (Germany), which hosts our servers.
- Cloudflare, for site delivery, security, Turnstile and the country of install telemetry.
- Google, for Google Analytics, the YouTube player, the Gmail copy of briefs and Nous app notifications.
- OpenAI, for advisor answers.
- Authorities, when the law requires it.
We do not sell personal data.
Transfers outside the EEA
Cloudflare, Google and OpenAI may process data outside the European Economic Area, including in the United States. Those transfers rely on the transfer terms these providers offer their customers, such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where the provider is certified.
Legal bases
- Our legitimate interests in running, securing and improving the site, answering the advisor and our email, and the server logs.
- Steps you ask for before a contract, and the contract itself, for briefs and pilot requests.
- Your consent, for Google Analytics, the waitlist and install telemetry. You can withdraw it at any time; this does not affect what was done before.
- Legal obligations, for contract and invoice records.
Your rights
You can ask us for access to your personal data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on our legitimate interests. Write to crew@spaceapp.dev; we answer within one month. You can also complain to the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens, Greece, www.dpa.gr, +30 210 6475600.
Changes
When we change this policy we update this page and its date.