Privacy Policy
Effective 10 November 2026 (version 2026-11-10).
Who we are and scope
We are Dory, and we run the Dory Agent Computers service. Privacy questions, access, export and deletion requests: support@dory.run. Use is for businesses and developers only. At launch you cannot sign up if you declare a country in the European Union or the United Kingdom, or a sanctioned country. We may add other countries later. We block access from sanctioned countries and areas.
Information used to operate the service
Account information includes email, password authentication records, enrolled authenticators and declared country. Login requires a password plus an enrolled authenticator code, or a passkey that verifies you. Password reset, email changes, recovery codes and account recovery are unavailable at launch, including through support. We strongly recommend enrolling a second authenticator, because there is no account recovery at launch. It is not required.
If we require identity verification, for example for a refund exception or a legal obligation, we collect only what that check needs and keep it for up to 3 years, the same period as our blocked location and sanctions decisions.
We use account and resource identifiers, usage records, login and network records, payment records, mail delivery evidence, abuse cases and location-check decisions to operate, bill and protect the service. Network connection records let us match a public IP, port and time to an account and computer. Diagnostic computer measurements are separate from billing records and never determine charges or deletion.
We check your IP location at sign-up, every login method, additional identity checks for sensitive actions, API access and top-up creation. If a location lookup fails, access is blocked. Location decisions are recorded without email, account id or secrets. Blocked decisions are kept for 3 years; allowed decisions for 90 days.
We send email verification only after a top-up is credited. The single-use link expires after 24 hours; a new link replaces the old one. A mail failure does not undo your credit. We do not send mail of any kind to an account that is both unverified and has no credited, non-reversed top-up. If that prevents a required deletion notice, deletion remains on hold.
Logging and retention
Command lines and content are never logged in platform logs. This includes command output, files and screenshots. API and console logs contain no request bodies; tokens are redacted. Your files, snapshots, saved memory and retained process output are service data, not request logs. Legal preservation is also separate from routine logging.
| Record | Retention |
|---|---|
| API and console logs (no bodies, tokens redacted) | 30 days |
| Login IPs | 90 days |
| Revoked or expired API-key details and usage | 30 days; we keep only the identifiers, without secrets, for as long as they are needed to link a key to resources or access still in use |
| Network connection records | 90 days |
| Customer DNS requests | 30 days |
| Server usage and records of computer starts, stops and other changes | 400 days |
| Billing ledger | 7 years |
| Abuse cases and location or sanctions decisions that blocked a request | 3 years |
| Location decisions that allowed a request | 90 days |
| Legal-hold material | as the hold requires (CSAM: 1 year) |
Diagnostic measurements expire after 24 hours. Mail delivery records are kept for 400 days, or longer while a related preservation hold requires them. Undelivered operational alerts are retained for 30 days. The events feed has 30 days of history. Each process retains at most 10,000,000 raw output bytes across standard output and error; this expires 1 hour after exit. Older output can be removed earlier as the buffer fills.
Deleted-computer records identify a computer as deleted for 30 days; after that, the API reports it as not found. This record is distinct from the computer's files. We keep an address permanently on our do-not-email list after a qualifying verified bounce or a complaint we record, to prevent further mail. Other mail failures and unverified reports do not add an address to that list.
Active account identity, authenticator records and ordinary mailbox correspondence are kept while your account is open and for 90 days after it closes. Law-enforcement request records are kept for 3 years. Legal holds can extend the applicable retention periods.
Service backups
Service records are included in encrypted recovery backups. We keep 14 successful daily and 8 weekly archives locally. A weekly copy kept outside the server is retained for 8 weeks. These copies can retain records beyond the ordinary periods above and after account closure. Customer computer disks are not included in these backups. We do not edit backup archives: they expire on the schedule above, and if we restore from a backup we reapply the deletions and suppressions made since it was taken.
Tracking and self-hosted services
We do not use analytics. We run BTCPay and mail ourselves. Checkout runs on pay.sacredgeometry.io, a payment server we run that is shared with other stores we operate. We use messaging services for operational alerts. We limit abuse notifications to sender, subject, ticket id and time, and remove links and attachment text from those fields. We do not forward message bodies, attachments or links. The messaging providers receive only those fields. This website sets no cookies and loads no third-party scripts, fonts or trackers.
Payment information and blockchain
BTCPay handles invoices and payment status. The invoice includes the amount and an order identifier linking it to your top-up, along with checkout settings and a return link. Receipts include the seller's legal name, your country, a tax line, amount, invoice id, new balance, and Bitcoin amount and rate when available from BTCPay.
We use the original paying address and transaction evidence to verify payments and refunds and check refund addresses against sanctions restrictions. Refunds go to the address that paid. If it cannot receive funds, the credit stays as service credit, unless after an identity review we agree to pay another address that belongs to you. The checkout server keeps ordinary web-server access logs (IP address, time, requested page and browser user-agent) for security and troubleshooting, for 30 days.
Bitcoin transactions are recorded on a public blockchain that anyone can read. The address, amount and time of your payment are visible there, cannot be erased by us or anyone else, and can be linked to you by anyone who can connect that address to you.
Payments are on-chain only unless we enable Lightning. If enabled, our payment server holds Lightning funds in an online wallet. We still verify who paid and apply the same refund-address rule.
Content access, mandatory reporting and legal requests
Traffic used to run commands, transfer files and use your computer's desktop or browser is decrypted as it passes through our gateway. A break-in at that gateway can expose traffic passing through it at the time. Our Terms reserve the right to inspect, snapshot, suspend and preserve for abuse handling and legal obligations. These rights do not change the prohibition on routine content logging.
On a report or detection of suspected child sexual abuse material (CSAM), we isolate access and preserve material for 1 year in restricted storage under legal hold. We report to NCMEC through its CyberTipline as the law requires. Our staff and our automated tools never browse suspected material. We do not open, view or copy it beyond what reporting needs.
Law-enforcement requests go through support@dory.run. We verify each request by calling the agency at an independently found number. Legal process is required for content. Preservation is not permission to disclose. We make emergency disclosures without legal process only where we believe in good faith that there is an imminent danger of death or serious physical injury, and only what that emergency requires. We do not notify customers about law-enforcement or CSAM matters while a non-disclosure obligation may apply. Once we have confirmed that none applies, we notify the affected customer. If we must preserve data, you cannot delete or overwrite it, and the refusal will say so.
Export, deletion and holds
Download your files before deleting resources. To close an account, export your files, delete computers, images and snapshots, request any eligible refund of unused paid credit, then close the account. To request an account export or closure, email support@dory.run from the account's email address; we verify the request before acting on it.
Accepted customer deletion purges files after 24 hours, subject to holds. At low balance, deletion may begin on day 14, followed by 7 days of recoverable storage; day 21 is the earliest permanent deletion if nothing delays it. Every safeguard and recovery condition in the Terms applies. Saved memory after 30 days paused is discarded after 7 days' notice, unless held. Snapshots follow their source computer; private images survive ordinary source deletion and must be managed separately.
A legal hold blocks deletion on the ordinary schedules, including if we close the service. A deletion refused because of a hold does not stop billing. Stop and pause can preserve held data. Closing an account does not erase billing records, required logs, backup copies or held evidence before their applicable retention ends.