01
Who we are
Runny.sh is the script-hosting service at https://runny.sh. These pages describe that product: paste a script, get a raw HTTPS URL, fetch the exact bytes. We do not run your code on our servers.
Questions about this policy: abuse@runny.sh. Enterprise accounts: enterprise@runny.sh.
02
What we collect
Account
When you sign up we store the email address, display name, and a password hash. If you enable an authenticator, the TOTP secret is encrypted with the application key. Recovery codes are stored as hashes and shown once. API tokens are stored as hashes with a visible prefix.
Scripts
Script bodies live in a revisions table, separate from listing metadata (title, slug, visibility, expiry). We keep the bytes you saved so /r/{slug} can serve them. Public scripts are scanned on save. Private scripts require a fetch token; the token is not a login session.
Fetches and executions
When someone fetches a raw URL we record a truncated HMAC of the client IP and user-agent, not the raw address or header. Execution analytics (fetch, started, complete) use those hashes plus action-bound HMACs. A leaked execution id is not enough to forge a callback.
Teams
Team name, membership, roles, invites, and an audit log of workspace actions. Invite emails go to the address you enter.
Abuse reports
Reports submitted at /abuse or mailed to abuse@runny.sh: the URL or slug, your explanation, and any contact email you include.
We send transactional mail only: welcome, password reset, team invites, MFA changes, share notices, and report receipts. Messages are branded HTML with a plaintext alternative. Links in mail do not include tracking query strings or open pixels.
Billing
If you subscribe, we store Stripe customer and subscription identifiers, plan state, and seat counts. Card numbers never touch Runny servers. See Payments.
03
How we use it
- Operate the product: sign-in, sessions, script hosting, fetch, teams, analytics, and the API.
- Scan public scripts, rate-limit fetches, quarantine or remove abuse, and enforce account threat marks.
- Bill Pro, Teams, and team seats through Stripe, and show you plan status in Settings.
- Email you about the account and the teams you belong to. We do not sell your address or send marketing campaigns.
- Defend the service: rate limits, session cookies, and operator review of reports.
04
Payments
Paid plans are processed by Stripe. Runny never receives or stores full card numbers, CVC, or bank details. Stripe’s privacy policy is at stripe.com/privacy.
Checkout and the customer portal run on Stripe’s domains. When you pay or manage a subscription, Stripe may collect billing name, address, and payment method under their terms. We receive webhooks so we can provision Pro and seats on this site.
06
Retention
Account records stay until the account is closed. Script bodies stay until you delete the script or we remove it for abuse. Fetch and execution hashes stay with that script’s analytics. Sessions live in Redis and the runny_sid cookie lasts 14 days. Password-reset and invite tokens expire. MFA setup challenges expire in minutes.
There is no self-serve account deletion in the product today. Email abuse@runny.sh to close an account and ask us to delete personal data we no longer need to operate or secure the service.
07
Security
Passwords are hashed. Authenticator secrets are encrypted at rest. Sessions are HttpOnly cookies. Raw script responses do not set a session cookie. We hash IPs and user-agents rather than storing them in the clear. Public scripts are scanned; that scanner is heuristic, not a guarantee.
No hosting provider can promise perfect security. If you believe there is a vulnerability in Runny.sh, write abuse@runny.sh.
08
Your choices
You can update your name and password, enable or disable MFA, revoke API tokens, delete or revoke scripts, and leave a team from the product. You can cancel a paid plan through the Stripe billing portal linked from Settings.
If you are in a region that grants access, correction, deletion, or portability rights, email abuse@runny.sh with the address on the account. We will need enough information to verify it is you.
Cookies are described in the Cookie Policy. Using Runny.sh is also subject to the Terms of Service.
09
Contact
Privacy and abuse: abuse@runny.sh. Enterprise: enterprise@runny.sh. We may update this policy when the product changes. The date at the top is the current version.