Privacy Policy

This Privacy Policy describes how Superheat ("Superheat", "we", "us") collects, uses, and shares information when you use our websites (including superheat.xyz and cloud.superheat.xyz), our mobile application, our web consoles, our Superheat H1C device, and our GPU cloud services (together, the "Services").

Information we collect

Information you provide

• Account information — such as your name, email address, phone number, and region when you create an account, join a waitlist, place an order, or contact us.
• Sign-in information — if you sign in with Google or GitHub, we receive basic profile information from those providers (your name, email address, and avatar). We never receive your password for those services.
• Payout information — if you use earnings features, the Bitcoin wallet address you provide for payouts. Transactions on the Bitcoin network are public by design.
• Support communications — messages, attachments, and ticket contents you send to our support channels.

Information collected automatically

• Device telemetry — Superheat H1C devices report operating data to us, including temperatures, power consumption, compute performance (such as hashrate), error codes, software version, and the device's network address, so we can operate, monitor, and support the device.
• Cloud host telemetry — machines enrolled in Superheat Cloud report similar operating data (GPU health, utilization, temperatures, network reachability) needed to schedule and monitor workloads.
• Usage data — logs and analytics from our websites and apps, including pages viewed, approximate location derived from IP address, and device/browser type. We use Google Tag Manager and related analytics cookies on our websites.

Information from third parties

• Payment status — our payment processor (Stripe) tells us whether a payment succeeded. Card numbers are handled by Stripe and never touch our servers.
• Mining pool data — for earnings features, we receive worker status, revenue, and balance data from mining pool providers associated with your devices.

How we use information

• To provide, operate, and support the Services.
• To calculate, display, and pay out earnings associated with your devices or account.
• To send service communications — sign-in codes, device alerts, order and payment confirmations, and support replies. Marketing emails, where sent, include an unsubscribe option.
• To secure the Services, prevent fraud and abuse, and debug operational problems.
• To improve our products and understand how they are used.
• To comply with legal obligations.

How we share information

We do not sell your personal information. We share it only with service providers that help us run the Services, under agreements that limit their use of it:

• Infrastructure and hosting — cloud hosting, database, and content-delivery providers (including Supabase, Amazon Web Services, Railway, Vercel, and Cloudflare-fronted services).
• Payments — Stripe, for payment processing.
• Communications — email delivery (Resend) and mobile push notifications (Expo).
• Sign-in providers — Google and GitHub, when you choose to sign in with them.
• Mining pools — pool providers that process compute work and account for earnings.
• Analytics — Google analytics services on our websites.

We may also disclose information if required by law, to protect our rights or users' safety, or as part of a corporate transaction (such as a merger or acquisition), in which case this policy will continue to apply to previously collected information.

GPU cloud workloads

If you rent compute through Superheat Cloud, the container images, commands, and data you run are processed on our behalf solely to execute your workload. Operational metadata about workloads (such as state, resource usage, and exit codes) is retained for scheduling, billing, and support. Workload data on a machine is removed when the workload is terminated, subject to short operational retention for logs and diagnostics.

Data retention

We keep account information for as long as your account exists. Telemetry and operational logs are retained on rolling windows sized for support and reliability engineering, then deleted or aggregated. Financial records (orders, payouts, invoices) are kept as required for tax and accounting purposes.

Security

We use industry-standard measures to protect information: encryption in transit, access controls and role separation on internal tools, encrypted secret storage, and audit logging on administrative actions. No system is perfectly secure; we encourage unique passwords and keeping your sign-in email account protected.

Your choices and rights

• You can access and update account information in the Superheat App or web consoles.
• You can delete your account in the app, which removes your personal information subject to records we must keep (such as financial records).
• You can opt out of non-essential emails via the unsubscribe link, and control push notifications in your device settings.
• Depending on where you live, you may have additional rights (such as access, portability, correction, or deletion). Contact us to exercise them.

International transfers

We are based in the United States and process information there. If you use the Services from elsewhere, your information will be transferred to and processed in the United States.

Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy as the Services evolve. We will post the updated version here and adjust the "Last updated" date; for material changes we will provide additional notice.

Contact us

Questions or requests: privacy@superheat.xyz or via our contact page.