Privacy Policy
What Mayfly stores, why it stores it and how long it keeps it. The short version: the minimum needed to run an invite-only host, deleted with your boxes or on request, plus Google advertising cookies on public pages.
on this page
1 · Who we are and scope
Mayfly is a small, invitation-only hosting service operated by a private individual. This policy covers the public site at mayfly-24h.pages.dev, its documentation and policy pages, the access request and invite flow, and the signed-in control panel and boxes.
“Mayfly”, “we” and “the operator” refer to the individual running this service. The service is not a company and does not have a separate data protection officer. Privacy questions and requests go to the operator through the contact page.
2 · What is collected
- Account data: username, role, salted scrypt password hash, allocated limits, account state and timestamps. We do not store plaintext passwords.
- Access requests: the requested username, contact handle or email address, the note you submit, IP address and time of the request.
- Invites: username, contact label, limits, expiry and a SHA-256 hash of the invite code. The plaintext code is shown once and is not stored.
- Session and security data: a signed session cookie, IP address, user agent, and events such as sign-in, failed sign-in attempts, admin actions and console commands.
- Box content: files you upload, box metadata, process output logs, allocated ports and temporary tunnel URLs. The operator can see box content.
- Runtime operations: process start and stop times, memory usage samples, exit codes and error messages needed to operate the box.
- Host telemetry: aggregate CPU, memory, disk space and I/O rates, network totals and temperatures for the control room. This telemetry is not linked to a customer account.
- Advertising data on public pages: Google and its partners may collect cookie identifiers, device information, approximate location and interaction data to serve and measure ads. See the advertising section and the cookies page.
Do not submit sensitive personal data, passwords, private keys or confidential information through the access request form or a box. The service is not designed to process that kind of information.
3 · Why it is collected
Account and request data is used to review applications, authenticate users, allocate and enforce limits, operate tunnels and boxes, investigate abuse or security incidents, and keep the laptop from failing under load. Security logs are used to detect and respond to unauthorized access.
Public-page advertising data is used by Google and its partners to deliver, measure and personalize advertising, subject to their own policies and your choices. Mayfly does not sell your personal information. Mayfly does not use a separate first-party analytics product.
Where a legal basis is required, Mayfly relies on the necessity of processing to provide the service you requested, the operator's legitimate interest in keeping a small shared host secure and available, compliance with legal obligations, and consent where applicable (for example, for non-essential advertising cookies where such consent is required).
5 · Google AdSense and third-party vendors
Public content pages on Mayfly use Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
You can opt out of personalized advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalized advertising by visiting aboutads.info or, in the European Economic Area, Your Online Choices.
Google's collection and use of information is governed by its own policies. Read the Google Privacy Policy and How Google uses cookies in advertising. Opting out of personalized ads does not mean you will stop seeing ads; it means the ads may be less relevant to you.
Mayfly does not control the specific ads that Google displays and does not receive the advertising cookies or the personal data that Google collects through them. Mayfly may receive aggregate revenue reports and estimates from Google.
7 · Retention
- Boxes and their process logs: until the 24-hour expiry, or earlier deletion by the owner or operator.
- Access requests and invites: until the operator deletes them; invites also expire after 48 hours.
- Activity events: the newest 150 events are retained in the control room; older events roll off.
- Accounts: until you ask the operator to delete the account or it is removed for abuse or inactivity.
- Advertising data: controlled by Google and its partners according to their retention policies, not by Mayfly.
Because access requests, accounts and invite records are stored on the host, deletion may require action by the operator. Ask through the contact page if you want a record removed.
8 · Security
Passwords are stored as salted scrypt hashes. Session cookies are signed, HttpOnly and Secure through the public site. Writes require a CSRF header, and the control panel applies rate limits and login auditing. Static HTML is served with a sandboxed content security policy.
No system is perfectly secure. Runtime boxes run inside a per-box sandbox limited to their own folder, their Node or Python tooling and outbound internet. If the host cannot start the sandbox helper, the box page shows an explicit unsandboxed warning. The 512 MB cap is a resource limit, not the security boundary. Do not store sensitive information in a box, and only run code you trust.
9 · Your choices and rights
Depending on where you live, you may have rights to access, correct, delete or port your personal information, object to or restrict certain processing, or withdraw consent. You can delete your boxes at any time. To make an account or privacy request, use the contact page and include enough information for the operator to identify the account without exposing your password.
You can control cookies through your browser and through the advertising choices linked above. Blocking essential cookies will prevent you from signing in. Blocking third-party advertising cookies may not prevent all ads from appearing. Mayfly does not currently respond to browser “Do Not Track” signals as a separate technical mechanism.
If you believe a privacy request has not been handled appropriately, you may have the right to contact your local data protection authority. The operator is a private individual, not a public authority.
10 · Children
The service is not directed at children. No one under 13 may create an account, and you must be old enough to enter into a binding agreement in your jurisdiction. If you believe a child has provided personal information, contact the operator so it can be removed.
11 · International processing
The host is physically located in one country, while Cloudflare and Google operate globally. Request data and page traffic may be processed in countries other than your own. Those providers maintain their own safeguards for international transfers. Mayfly cannot guarantee that the host's location or the providers' infrastructure will always match your region's privacy expectations.
12 · Changes
This policy may be updated as the service or its providers change. The date at the top of the page is the current version. Material changes will be reflected here. Continuing to use Mayfly after an update means you accept the revised policy.
13 · Contact
Privacy questions, deletion requests and concerns about advertising should go through the contact page. There is no separate data protection officer, support desk or guaranteed response time.
This is a plain-language description of a private hobby service, not legal advice.