SpawnDroid runs Android in containers on ARM64 hosts we operate. This page is the short version of the controls behind that sentence: what is isolated, what is stored, how long it stays, and how to remove it. The privacy notice is the legal detail.
Session isolation
Every session gets its own Android container, and the container is destroyed when the session ends. App data, package state and device identity do not carry between sessions or workspaces. The browser stream and the Appium endpoint point at that same isolated device; there is no shared desktop, shared phone or shared filesystem.
What is stored
- Uploaded builds (APK or AAB) and the metadata read from the manifest: package name, version, icon and size.
- Run metadata: session id, workspace, app, device profile, timestamps, outcome and failure code.
- Retained logcat and screen recordings on Personal and above. Hobby has the live logcat stream only.
- API keys as SHA-256 hashes, share-link tokens as hashes, and share-link passwords as salted hashes. The raw values are shown once and cannot be recovered.
- Support conversations you send us. Do not paste API keys, passwords or other secrets into a support message.
Retention
- Hobby keeps 7 days of execution history. Every build expires 7 days after upload, including the newest one; upload it again to run it.
- Personal keeps 30 days, Team 90 days, and Enterprise can contract up to 12 months.
- Paid plans always keep the newest release of each app. Retained logcat and recordings are cleared on the same window as run history.
- A nightly sweep removes expired artifacts. Opening the dashboard also triggers an opportunistic sweep, so an active workspace stays tidy without waiting for the next night.
Deletion
Delete an app or a build from the console and it is removed from object storage. To close a workspace and delete its stored data, email engineering@spawndroid.io and we will process the request. Billing records are held by Polar as merchant of record under its own legal obligations.
Access control
The console and API are authenticated per workspace. A member only sees workspaces they are invited to. API keys carry a scope (read, upload or full), only their hash is stored, and revoking a key stops pipelines using it immediately. Share links are opaque tokens scoped to one build, expire on the plan's window, can be password protected on Team, and can be revoked by a workspace admin.
Analytics and replay
The marketing site and docs ask for consent before PostHog runs and load no analytics until you accept. The console uses PostHog for product analytics, error monitoring and support under the workspace agreement. Shared preview pages load no browser analytics SDK at all; we record only a server-side view against the workspace that created the link, with no cookie or visitor identifier. Live device screens, logcat, API keys, share links and CI tokens are never recorded, and the player, log buffers and credential blocks are excluded from replays.
Infrastructure
- Clerk: authentication and organization management.
- Vercel: console hosting.
- Cloudflare: Pages hosting, DNS and object storage.
- Neon: managed Postgres and S3-compatible object storage.
- Oracle Cloud: the ARM64 device host that runs Android sessions.
- PostHog: analytics, error monitoring, support conversations and workflow email delivery in the US region.
- Polar: payment processing and merchant of record. SpawnDroid does not store card numbers.
Reporting a security issue
Email engineering@spawndroid.io with the steps to reproduce, the affected URL or endpoint, and the impact you believe it has. We will acknowledge the report and coordinate disclosure with you. Please test only against your own workspace; do not access another tenant's data, run destructive traffic, or test the device host outside the console.
Status
Live platform status is published at status.spawndroid.io. Capacity errors in the console are reported with an HTTP status and a retry hint; there is no hidden queue.