Abyss Privacy Policy

Last updated: November 3, 2026

In short

  • We are Abyssal Corporation. Write to support@abysshub.com about anything on this page.
  • We keep what Abyss needs to run: your account, your Runs, your payments, and an activity record with IP addresses, kept for 180 days.
  • Abyss shows your Run to you alone, unless you share it. On a Covered link, the link's owner sees it too.
  • A Widget is its Creator's code. It receives what you put into a Run, and can keep it or send it on.
  • Abyss runs in the US, and the services named below receive data to run it. Where the law asks for your consent first, Google Analytics loads only if you say yes; elsewhere it loads unless you turn it off.
  • You can delete your account from your Cave, and ask us for a copy of your data or to correct it.

The full text below is what counts.

1. Who we are

Abyss is run by Abyssal Corporation, a Delaware corporation ("Abyss", "we", "us"). We decide what happens to the personal data on this page, which makes us its controller under the GDPR. Our privacy contact is support@abysshub.com.

This policy covers abysshub.com, every Studio address, the Abyss API at /v1, and everything else we run under the Abyss name. It covers everyone who uses them: people with an account, people without one, and Guests on a Covered link. Our Terms define the words it uses, such as Widget, Run, Creator, Runner and Guest.

2. What we keep, and for how long

Your account

  • Your email address, username, password (kept only as a hash), profile picture, and anything else you add to your profile. If you sign in with Google or GitHub, they send us your email address and the profile details you share with them.
  • The links we email you, such as one to confirm your email address or reset your password.
  • How you arrived: the campaign tags in the link you followed, the site that sent you and the first page you opened, kept only where Google Analytics may run for you.
  • Your API keys. A key's secret is kept only as a hash.
  • A Session, which keeps you signed in, lasts up to 6 months unless you log out.

Your Widgets, if you are a Creator

  • Their Source, listings, Drafts and Runs, and what they earn.
  • Your Creator Environment, which is encrypted at rest.
  • A Draft nothing has touched for a week is erased.

Your Runs

  • A Run's inputs, the files it makes, its Result and its logs.
  • A file you add to a Run is deleted a day after upload if you never press Run, or 7 days after if you pressed Run and it is still waiting to start.
  • A Run's files are never deleted for their age. When nobody has opened a Run with large files for 180 days, its files go to sleep, and waking them takes up to 12 hours.
  • A Run you delete can be restored for 30 days. Then its files and everything it held are erased, and only a record of the Byssium it moved stays.
  • A Guest's Runs are tied to a Guest key that the Covered page keeps in the Guest's browser. We keep the key only as a hash.

Payments and payouts

  • Stripe takes your card details; they never reach us. We keep your card's brand and last four digits, the country of your billing address, and a VAT ID if you give one.
  • Each top-up and each earning records the card's country.
  • TaxBandits holds Tax Forms, not us. We keep whether yours is done.
  • We keep payment and tax records for as long as the law makes us.

The activity record

  • To keep Abyss secure and to run it, we record the IP address you use when you sign up, sign in, run a Widget, open a page or search, with the text of your search. We also record what changed on a Run: its inputs, its Result and its logs.
  • The activity record is kept for 180 days.

How many people use Abyss

  • We count each arrival at Abyss from the page request itself: the page, the site that sent you, the campaign tags, the country, and whether it's a phone or a computer. We keep only daily totals, never your IP address, and we never tell one arrival's person from another's.
  • When you're signed in, we note each day you use Abyss, only the date, to count how many people use it. Each day is kept for 13 months; after that, only the totals stay.

Logs and error reports

  • Our servers' logs can hold IP addresses. They are kept for 30 days.
  • When something breaks, Sentry receives an error report.

What you post

  • Requests, Ratings, Reviews and comments are kept while your account is open.

What we read but don't keep

  • We read the country your connection comes from to show you prices for it, to know whether to ask before Google Analytics loads, and to count arrivals by country. It is never kept with anything about you.

Your browser keeps a few things too, such as your analytics choice. Our Cookies page lists them.

3. Who sees your Runs

  • Abyss shows a Run to its Runner alone, unless they share it. Anyone who can see a Shared Run's Widget can open it, signed in or not.
  • A Run made through a Covered link is also shown to the link's owner, in full.
  • A Creator never sees a paying Runner's name or inputs through Abyss.
  • Abyss's admins can see Runs.

A Widget is its Creator's code. When you run a Widget, your inputs go to that code. It may keep them, or send them to services its Creator chose, such as an AI model. The Creator answers for what their Widget does with them. Decide what you put in with that in mind.

4. Services that receive data

These services receive personal data to run their part of Abyss:

  • AWS: storage, delivery, compute, the database and email.
  • Fly.io: Run inputs, the Creator Environment and the files a Run makes, since every Widget runs there.
  • Stripe: payments, tax, payouts and identity checks.
  • TaxBandits: Tax Forms and tax filings.
  • Google: sign-in with Google; reCAPTCHA, which receives your IP address when you sign up or run on a Covered page; and Google Analytics, where the law lets it load unless you turn it off, and elsewhere only if you say yes.
  • GitHub: sign-in with GitHub.
  • OpenAI: listings and search queries, to make search work, and a Creator's code when they press Generate for a description.
  • Pusher: live notifications.
  • Sentry: error reports, and how long some pages take to load.

We have accepted AWS's, Stripe's, Sentry's and Google's data processing terms.

We may also share personal data when the law requires it, to protect Abyss or someone's safety, or with a buyer if Abyss is merged or sold.

5. Where your data is

Abyss is hosted in the US: on AWS in its us-east-1 region, and on Fly.io in its Ashburn region, where every Widget runs. If you use Abyss from outside the US, your data is processed in the US.

6. Email

We email you about your account and your Widgets. We may also send news about Abyss, each email with a one-click unsubscribe. We ask nothing about it at sign-up. In the EU and the UK, we send news only to people who have bought something from us or who have asked for it.

7. Deleting your account

You can delete your account from your Cave. For 30 days, you can sign in and restore it, with everything as it was. Then we erase your personal data, keeping only what the law makes us keep, such as payment and tax records.

  • Your Widgets and their Source, your Ratings and your Reviews are erased. So are your Runs, except a record of the Byssium each one moved.
  • What you wrote in Requests, Answers, Discussions and Comments stays, without your name, because other people's replies build on it.
  • Runs other people made with your Widgets stay theirs.
  • Your email address and username become free again.

If you can't sign in, write to support@abysshub.com from its email address.

8. Your rights

Wherever you live, you can ask us for a copy of your personal data, to correct it, or to erase it. Write to support@abysshub.com from your account's email address. We may ask you to confirm it's you. You can change most of your account details yourself, in your Cave.

You can change your analytics choice at any time, from the Cookies page, and unsubscribe from news from any news email.

9. If you are in the EU or the UK

The GDPR, and the UK's version of it, let us use personal data only on a legal basis. Ours are:

  • To provide Abyss under the Terms: your account and Session, your Widgets and Runs, Byssium, payments and payouts, notifications, and email about your account and your Widgets.
  • To meet the law: payment and tax records, Tax Forms, the tax withheld from earnings, and answering lawful requests.
  • Our legitimate interests, in keeping Abyss secure, running and improving it: the activity record, logs, error reports, reCAPTCHA, the Payout Hold, counting arrivals and the days you use Abyss, search, and news to people who have bought something from us.
  • Your consent: Google Analytics, how you arrived, and news to people who have asked for it. You can withdraw consent at any time, which doesn't affect what we did before.

You have the right to:

  • get a copy of your personal data, and get it in a form you can take elsewhere;
  • have it corrected;
  • have it erased;
  • have its use restricted;
  • object to our use of it on legitimate interests, and to news at any time;
  • complain to the data protection authority where you live or work, or in the UK, to the Information Commissioner's Office.

To use any of them, write to support@abysshub.com. We answer within a month.

You don't have to give us personal data, but without an email address we can't open an account, and without payment details you can't buy Byssium.

Abyss is in the US, and so is the processing of your data (section 5). US law may not protect it the way the law where you live does.

Two things happen automatically: a Widget whose Runs keep failing is Frozen, and a withdrawal funded by fresh or unusual payments can wait in a Payout Hold. If you think one got it wrong, write to us.

10. California

Do Not Track and Global Privacy Control. Abyss doesn't change what it does for Do Not Track. It takes Global Privacy Control as a no to Google Analytics. We don't sell your personal data, or share it for advertising.

Tracking by others. When Google Analytics loads, and when Google's reCAPTCHA and Stripe's payment form load, Google and Stripe may collect information about your activity over time and across other sites, under their own policies.

11. Children

Abyss is for people 18 and older, as our Terms say. If we learn that an account belongs to someone under 18, we may close it and erase its data.

12. Changes

We may change this policy. We tell you ahead of time about a change that matters, by email or on Abyss, and the date at the top changes.

13. Contact

Write to support@abysshub.com about your personal data or anything on this page.