Privacy Policy

Last updated: 2026-05-19. Scope: This policy covers data Lesshq collects through surfaces Lesshq operates. It does not cover your self-hosted Pileless™ deployment — that data lives on your Cloudflare account and Lesshq has no access to it.

Related: TERMS · TRADEMARKS · FAQ · SECURITY.

What this policy covers

Lesshq operates a small number of public-facing surfaces:

• The pileless.com landing page and any Lesshq-operated marketing pages.
• A public demo Pileless instance (used to show the product to first-time visitors).
• The Pro waitlist sign-up form at lesshq.app.
• Inbound email to [email protected], [email protected], and related addresses.

This policy describes what Lesshq collects through those surfaces.

What this policy does NOT cover

If you self-host Pileless on your own Cloudflare account, Lesshq is not a processor of your data. Your Pileless instance talks to your Cloudflare account directly. Lesshq operates no telemetry, no phone-home, and no centralized service that your self-hosted instance reports to. The OSS code is free of analytics SDKs and tracking calls; you can verify this by searching the repository.

Privacy obligations for end-users of a self-hosted instance are the self-hoster's responsibility (as the data controller and processor).

What Lesshq collects on Lesshq-operated surfaces

• Landing-page analytics. Aggregate page views, referrer, country, browser family. We use a privacy-preserving analytics provider; we do not place advertising cookies. Disclosed in the site footer with the provider name.
• Pro waitlist form. Email address and optional company name, only when you submit the form. Used to notify you when Pro ships. Stored in our email provider. You can unsubscribe at any time via the link in any email we send.
• Public demo instance logs. If you use the public Pileless demo at pileless.com, the demo instance generates audit-log rows the same way a self-hosted instance does: actor identity (session-scoped), Pile IDs, timestamps, IPs, user-agents. Demo data is retained for 30 days and then deleted. Demo Piles are isolated per session; do not put real, sensitive, or private content into the demo.
• Inbound email. When you email [email protected] we retain the message and your reply address as long as needed to respond and for reasonable record-keeping (12 months typical).

What Lesshq does NOT collect

• We do not collect data from self-hosted Pileless instances.
• We do not run telemetry, error reporting, or version-check pings from the OSS code.
• We do not sell, rent, or trade any data we collect.
• We do not place advertising or cross-site tracking cookies.

Cookies

Lesshq surfaces use a small number of first-party cookies for session state and (where applicable) privacy-preserving analytics. No third-party advertising cookies.

Sub-processors

For Lesshq-operated surfaces only:

• Cloudflare — hosting, DNS, CDN.
• Privacy-preserving analytics provider — landing-page analytics; named in the site footer.
• Email provider — Pro waitlist and inbound mail handling.

Self-hosted instances have no Lesshq sub-processors.

Your rights

For data Lesshq holds about you (waitlist email, demo logs, support correspondence):

• Request a copy of what we have.
• Request deletion.
• Request correction.

Email [email protected] with the request. We aim to respond within 30 days.

Changes

We may update this policy. Material changes will be flagged at the top of this file with a date. We don't currently maintain a separate mailing list for policy updates; subscribe to the repository for changes.

Contact

[email protected]. For security findings, see SECURITY.md.