Legal

Privacy Policy

Effective date: October 15, 2026

This policy explains what information Homestretch collects, how we use it, who we share it with and how, and how we protect it. Homestretch is a service of Onyx Haven Labs ("we," "us"). It covers onyxhavenlabs.com/homestretch and the work we do for you.

1. Information we collect

What you give us on the intake form:

• Your GitHub repository URL
• Your email address
• Your description of what "done" means for your app

What we record automatically when you submit the form:

• The date and time of your submission, and any founding-discount spot assigned to it
• A one-way hashed (scrambled) version of your IP address. We use it only to limit spam and repeat submissions. We do not store your raw IP address with your submission.
• Your browser's user-agent string (browser and device type)

Your code and project materials: if you go ahead with a project, you give us read access to your GitHub repository (a public link or a read-only collaborator invite). We may also receive project notes you email us (requirements, preferred platform name). Do not send us API keys, production secrets, or passwords for hosting, cloud, or DNS accounts. We do not request those credentials. We work with mocks and demo data.

Payment information: Stripe handles payments. Stripe collects your card details and billing information directly. We never see or store your full card number. Stripe tells us whether a payment went through, along with basic details such as your name, email, and the amount paid.

Newsletter: if you sign up for the Homestretch newsletter, you sign up on Beehiiv's site, and Beehiiv collects your email address.

Emails: if you email us, we keep the messages and your contact details.

Cookies and analytics: this site does not use advertising trackers or third-party analytics scripts, and it does not set its own cookies. Cloudflare, our hosting provider, may process basic technical data such as IP addresses and request logs to deliver the site and protect it from abuse.

2. How we use your information

• To review your repository, write your scope, and send you a quote
• To do the work you approve: finishing and testing your app, preparing a pull request and deploy guide, and—when feasible—running a temporary demo preview on our infrastructure with fake data
• To process payments and apply founding discounts. Each email address can get one discounted project.
• To talk with you about your project and answer your questions
• To send the newsletter, but only if you subscribed
• To prevent spam, fraud, and abuse, and to keep the service secure
• To keep business, tax, and accounting records and to meet legal obligations

We use your code only to do the work you asked for. We do not claim ownership of it, and we do not use it to build other products.

3. Who we share it with, and how

We do not sell your personal information, and we do not share it with advertisers. We share it only with service providers that help us run Homestretch, and only as much as they need to do their job:

• Stripe processes payments. You enter payment details on Stripe's checkout page, so they go straight to Stripe.
• Cloudflare hosts the site and stores intake submissions in its D1 database. Form data goes to Cloudflare over an encrypted (HTTPS) connection when you submit it, and Cloudflare's email service may send us a notification about it.
• Beehiiv runs our newsletter. You give your email to Beehiiv directly when you subscribe.
• Apple iCloud hosts our email (custom domain). Emails between you and us pass through and are stored on Apple's servers.
• GitHub hosts your repository. We read your code through GitHub with the read permissions you grant (public URL or read-only collaborator).
• AI and coding tools. We use AI agents and software development tools, with human oversight, to read, change, and test your code. Your code and project description are sent to these tools over encrypted connections, only as needed to do your project. We use mocks/demo modes—not your production secrets.
• Our temporary preview hosts (when used). If we provide a short-lived demo preview, it runs on infrastructure we control, with synthetic/demo data only, and is removed after handoff. We do not place your app into your cloud or DNS accounts.

We may also disclose information if the law requires it, to protect our rights or someone's safety, or as part of a business transfer such as a merger or sale. If that happens, this policy will continue to apply to your information.

4. How we protect your information

• All traffic to this site is encrypted with HTTPS.
• Intake data is stored in a Cloudflare D1 database. Only Onyx Haven Labs can access it, and our admin access requires a secret token.
• We store IP addresses only in hashed form, and we never handle card numbers.
• We ask only for GitHub read access. We do not collect your hosting, cloud, or DNS credentials, and you should not send us API keys. You can revoke our GitHub access at any time; we recommend doing so once your project is delivered.
• We use reputable providers with their own security programs, and we protect our own accounts with strong passwords and two-factor authentication where available.

No method of storing or sending data online is completely secure, so we can't guarantee absolute security. If we learn of a breach that affects your information, we will tell you as the law requires.

5. How long we keep it

We keep intake submissions and project information as long as we need them for your project and for normal business records, such as tax and accounting. We don't keep copies of your code after the project ends any longer than is reasonably necessary. You can ask us to delete your information at any time. We'll do so unless we have to keep it for legal or accounting reasons.

6. Your choices

• Ask to see, correct, or delete the personal information we hold about you by emailing homestretch@onyxhavenlabs.com.
• Unsubscribe from the newsletter using the link in any issue.
• Revoke our GitHub repository access at any time.

7. Children

Homestretch is not aimed at children under 13, and we do not knowingly collect their personal information. If you believe a child has sent us information, contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. When we do, we'll post the new version here and change the effective date. If a change is significant, we'll make reasonable efforts to let active customers know.

9. Contact

Questions or requests: homestretch@onyxhavenlabs.com. Onyx Haven Labs, operator of Homestretch.