What this server can and can't see

Machine Sync is end-to-end encrypted. Each Machine encrypts its data with a key created on your machines. The key is never sent to this site or this server, so we can't read your Spend, and neither can anyone who breaks into the server.

The Sync Server can see

• group IDs, Machine IDs, and how many Machines a group has;
• blob names, which reveal which UTC days each Machine had Spend (the server needs them to delete data older than 400 days);
• blob sizes (padded to 1 KiB steps), write times, each Machine's last-seen time, and client IP addresses;
• the Enrollment Token used to create each group, and so the link between a paying customer and a group ID.

The Sync Server can't see

• Spend amounts, tokens, providers, models, Machine names, or platforms.

Payments

Stripe processes payments. Stripe collects your email address and payment details; this site never receives your card details. This site stores your Stripe customer and subscription IDs, the subscription's status and end date, and which Enrollment Token it paid for. It stores only a hash of the token, not the token itself.

Your Pairing Link

Anyone holding your Pairing Link can read and write all of your group's data. There's no way to revoke a single Machine. If a link leaks, create a new group and pair each Machine again.

Retention and deletion

• Daily data older than 400 days is deleted automatically.
• You can delete a Machine, or the whole group, from UsageBar at any time.
• When a subscription ends, writes stop and reads keep working for 30 days so you can move to another server.

This follows section 10 of the Machine Sync protocol. The server's source code is public.