This policy explains what Fylo.Host collects, why, who helps us process it, how long we keep it and what you can do about it. Fylo.Host ("we", "us") is operated from Road No-17, VKI Area, Jaipur, Rajasthan, India. It covers fylo.host, the dashboard, the API and the MCP server that AI apps connect to.
For your account and your use of fylo.host, we decide how the data is used. For the sites you host and the form submissions your visitors send, you decide and we only process that data for you, on your instructions.
1. What we collect
Account. Email address, name, and either a password (stored only as a salted hash) or a Google sign-in (we receive your email and name from Google). Your plan and subscription status.
Your content. The files, pages, blog posts, images and saved site versions you publish, from the website, the API or a connected app.
Form submissions to your sites. When a visitor submits a Fylo form on a site you host, we store the fields they sent, their email if provided, IP address, country, the page it came from and a spam-check result, and email the submission to you.
Payments. Paid plans are billed by our payment partner, Dodo Payments. We receive your subscription id and status. We never see or store card details.
API keys and connected apps. API keys and the access tokens of AI apps you connect (for example Claude or ChatGPT through our MCP server) are stored only as hashes. We keep the app name, when you connected it and when it was last used.
How fylo.host is used. Pages viewed, buttons clicked and errors, through PostHog (if analytics cookies are on, see section 4). Account events such as sign-up, a completed upload or a subscription change are recorded against your account id. On our homepage, Microsoft Clarity may record how visitors scroll and click; typed input is masked.
Visitor statistics for hosted sites. For each site we count views by page, referrer, country and device type, plus time on page and bounce. These counts carry no IP address and no visitor identifier. To count unique visits, a small marker is kept in the visitor's own browser storage on that site (_fvw, _fud, _fylo_pv); it is never sent to us as an identifier.
IP addresses. Used for rate limiting and spam protection (Cloudflare Turnstile on sign-in forms), stored with abuse reports and with form submissions, and processed by Cloudflare for security.
Tools. The website speed checker sends the URL you enter to Google PageSpeed Insights and caches the result for 24 hours.
2. How we use it
To host and serve your sites, run the dashboard, the API and connected apps.
To send account email (verification, sign-in links, password reset, billing) and a short series of getting-started emails. Every getting-started email has a one-click unsubscribe.
To prevent abuse: rate limits, spam checks, automated scanning of uploads for malware and pirated media, and handling reports.
To understand and improve the product.
We do not sell personal data and we do not use your content or your visitors' form submissions for advertising or to train AI models.
3. Connected AI apps (MCP) and the API
When you connect an app, you approve it on a Fylo.Host page while logged in. A connected app or API key can publish and update your sites, write blog posts, read form submissions and visitor statistics, change speed settings and manage custom domains. It can not delete a site or your account, change billing or manage API keys. We send the app only what a tool call asks for; what the app's provider does with it is covered by that provider's own policy. Disconnect an app or revoke a key at any time under Settings → API in the dashboard; it stops working immediately.
4. Cookies and browser storage
Always on (needed for the service):
fylo_token — keeps you logged in (7 days).
fylo_claim — lets you claim a site you uploaded before signing up (1 hour). oauth_state — protects Google sign-in (10 minutes). fdl_* — signals that a download started (30 seconds).
Cloudflare Turnstile and security cookies on sign-in forms.
Analytics (optional): PostHog (ph_*) and, on the homepage, Microsoft Clarity (_clck, _clsk, and CLID/MUID on clarity.ms). For visitors in the EU/EEA, the UK and Switzerland these stay off until you accept them in the cookie banner. Elsewhere they are on by default. Anyone can change their choice here:
We do not use advertising cookies.
5. Who processes data for us
Cloudflare — hosting, storage, database, security and delivery of every site. Policy
Google — sign-in with Google and the PageSpeed tool. Policy
These providers may process data outside your country, including in the United States. We also disclose information when the law requires it or to protect our legal rights.
6. How long we keep it
Sites uploaded without an account: deleted after 30 minutes.
Sites on the free plan: removed after 45 days without a visit, following a further 7-day grace period.
When a paid subscription ends: sites on the paid plan and custom domains are removed after a 7-day grace period.
Saved site versions: the newest 3 to 24 per site, depending on plan; older ones are deleted automatically.
Form submissions: until you delete them or your account.
Visitor statistics: about 90 days. Rate-limit records: minutes to hours. Abuse reports: as long as needed to handle the report.
Connected-app tokens: 1 hour, renewable for 30 days. Account data: until you delete your account.
7. Your choices and rights
See, correct or export your data, withdraw consent, or ask us to delete it: email legal@fylo.host. We respond within 30 days.
Delete your account yourself from the dashboard (Settings). This removes your sites, saved versions, blog content, form submissions, custom domains, API keys and connected apps.
If you are in India you may also nominate another person to exercise your rights and complain to the Data Protection Board of India; in the EU/EEA or UK you may complain to your data protection authority.
If you submitted a form on a site hosted by one of our customers, contact that site's owner first; we will help them respond.
8. Security
All traffic uses HTTPS. Passwords, API keys and app tokens are stored only as hashes. API keys and connected apps are limited to site-management actions. No system is perfectly secure; if a breach affects your data we will tell you and the relevant authority as the law requires.
9. Children
Fylo.Host is not directed at children under 13. If you are under 18, use it only with the consent of a parent or guardian.
10. Changes
We will update this page when the service changes and change the date at the top. For significant changes we will email account holders.
11. Contact and grievance officer
Ravi Kumar, Fylo.Host, Road No-17, VKI Area, Jaipur, Rajasthan, India. Email legal@fylo.host or use the Contact page. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.