Privacy Policy

CCAO ("by NEXTAO") is an open-source tool that helps you monitor and control cloud and AI spending across supported providers. This policy describes what information we process, why, and the choices you have. NEXTAO is not affiliated with Google Cloud, AWS, or OpenAI; all third-party trademarks belong to their owners.

• Account data: Email address and profile information from your Supabase authentication session (Google OAuth or email magic link).
• Cloud and AI connection metadata: The GCP projects, AWS accounts, and OpenAI projects or key IDs you link, plus encrypted credentials when you choose to store them.
• Cost observations: Hourly or daily spend samples pulled from provider usage APIs and billing exports, stored only to power your spend history and anomaly detection.
• Alert profiles: Budget thresholds, auto-kill toggles, and the alert email addresses you configure.

Cloud and AI credentials are encrypted at rest using AES-256-GCM with a key ( CRYPTO_SECRET ) that you control, and are never written to logs, never committed to the repository, and never exposed through API responses. If you prefer, you can use shared environment credentials instead of storing keys per project.

• Fetching and displaying your real-time cloud and AI spend.
• Enforcing the budget cap you configure, including detaching billing from a project when you have enabled the auto-kill feature.
• Detecting cost anomalies and sending you the email alerts you opted into.
• Improving the product through aggregated, de-identified metrics.

We do not sell your data. Data is shared only with the service providers that run CCAO: Supabase (hosted database/auth), Resend or your SMTP provider (email delivery), and Vercel (hosting). Each provider is bound by its own data-processing terms. When you self-host, you are the data controller.

Cost logs are retained while you keep them; you can delete any cloud or AI account, budget, or alert log from your dashboard. Deleting your account removes your associated records. Email alert history in third-party providers follows their retention policies.

• Turn auto-kill off at any time so CCAO never detaches billing.
• Use shared credentials instead of storing per-project keys.
• Opt out of analytics by leaving NEXT_PUBLIC_GA_MEASUREMENT_ID unset.
• Request export or deletion of your data at any time via the dashboard.

Questions about this policy or your data? Open an issue in the CCAO repository or contact NEXTAO at the address listed on the project page.