Privacy Policy
Effective 22 August 2026
1. Introduction
This Privacy Policy explains how ELLIPSE SOFTWARE GROUP LIMITED, a company incorporated in England and Wales with company number 16757915, trading as ellipse Software (“we”, “us”, “our”), collects, uses, stores, shares, and protects personal data in connection with Bast.sh.
This Policy applies to:
- visitors to bast.sh and related documentation;
- users of the Bast CLI and terminal interface;
- people who link a machine to Bast Vault;
- people who make a sponsorship payment;
- people who email us or otherwise contact us.
Bast.sh is a product and hosted service of ELLIPSE SOFTWARE GROUP LIMITED. The CLI is open source software. Vault, this website, and related APIs are hosted services we operate.
2. Data controller
For the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, ELLIPSE SOFTWARE GROUP LIMITED is the data controller unless we say otherwise.
Email: [email protected]
ELLIPSE SOFTWARE GROUP LIMITED
4th Floor Silverstream House, 45 Fitzroy Street, London, W1T 6EB, United Kingdom
3. Personal data we collect
3.1 Website
When you visit bast.sh, our hosting and network providers may process standard request data such as IP address, user agent, requested URL, referrer, approximate country, and timestamps. We use this to operate, secure, and debug the site. We do not run advertising trackers or client-side product analytics on the public website.
3.2 Vault accounts
If you link a machine to Bast Vault we process the email address you submit, one-time sign-in codes, hashed session tokens, device identifiers we generate, IP address used to request codes (for rate limiting), and vault revision metadata (size, hash, timestamp).
Vault contents (Bast-managed hosts, keys, and metadata) are encrypted on your machine before upload. We store an opaque ciphertext blob and cannot decrypt it. We do not receive your vault passphrase. Cloud provider credentials are not included in vault sync.
3.3 Sponsorships
If you sponsor Bast we process the amount, optional X username, optional message, and whether you asked to remain anonymous. Card and bank details are collected by Stripe. We do not store full payment card numbers.
3.4 Telemetry
The installer and CLI may send anonymous usage events to /api/telemetry: event name, version, operating system, architecture, and source (installer or CLI). We may attach an approximate country from the request. Events are stored against a non-identifying distinct ID. We do not collect hostnames, keys, emails, project IDs, or SSH config contents in telemetry.
Set BAST_NO_TELEMETRY=1 to disable usage telemetry and error reporting. See Telemetry.
3.5 Error reports
If an interactive session fails, Bast may offer to send an anonymous error report. That report can include the on-screen message, optional stack, version, OS, architecture, and a command or context label. Messages may contain local paths or labels. SSH session endings are not reported. Reports are sent only if you consent at the prompt.
3.6 Communications
If you contact us we process the content of that correspondence and any contact details you provide.
We do not intentionally collect special category personal data. We do not knowingly collect personal data from children under 13.
4. How we use personal data
We process personal data to:
- provide, operate, and secure the website and Vault;
- send vault sign-in codes and authenticate devices;
- store and retrieve vault ciphertext at your request;
- process sponsorship payments and display public sponsors;
- understand product usage and diagnose failures;
- prevent abuse, fraud, and unauthorised access;
- comply with law and enforce our terms;
- respond to enquiries.
We do not sell personal data.
5. Legal bases
Under UK GDPR we rely on one or more of:
- performance of a contract (vault accounts and the hosted service);
- legitimate interests (security, reliability, product improvement, operating the website);
- consent (error reports you choose to send);
- legal obligation;
- establishment, exercise, or defence of legal claims.
Legitimate interests include running and improving Bast.sh, keeping Vault available and secure, and preventing misuse. Where we rely on legitimate interests we consider the impact on your rights.
8. International transfers
Personal data may be processed outside the United Kingdom, including by providers in the United States. Where that happens we use appropriate safeguards recognised under UK law, such as adequacy regulations, the UK International Data Transfer Agreement, or standard contractual clauses.
9. Retention
- Vault one-time codes: 10 minutes.
- Vault session tokens: 90 days, or until you log out.
- Vault ciphertext and account email mapping: until you ask us to delete the vault, or we close the service and give reasonable notice.
- Logging out a device revokes that session. It does not delete the remote vault. Email [email protected] to request deletion of vault data associated with your email.
- Sponsorship records: as required for accounting, tax, and dispute handling.
- Telemetry and consented error reports: only as long as useful for product and security analysis.
- Server logs: for a short operational period, longer if needed for security investigations.
10. Security
We use access controls, TLS in transit, hashed session tokens, rate limits on sign-in codes, and encryption of vault contents on your device (Argon2id and XChaCha20-Poly1305) before they reach our servers. No method of transmission or storage is completely secure.
You are responsible for the vault passphrase, local files such as ~/.config/bast/vault-passphrase, and the security of machines that can read them. If the passphrase is lost we cannot recover the remote vault.
11. Your rights
Subject to UK law, you may have the right to:
- access your personal data;
- rectify inaccurate data;
- erase data;
- restrict or object to processing;
- data portability;
- withdraw consent where we rely on consent.
We cannot provide a plaintext export of vault contents because we cannot decrypt them. Requests: [email protected]. We may need to verify your identity. We may refuse or limit requests where the law allows.
12. Third-party services
Cloud sync with AWS, Google Cloud, Microsoft Azure, and other providers runs on your machine using credentials you supply locally. Those providers process data under their own terms and privacy notices. We are not responsible for third-party sites or services we do not operate.
If you self-host the web app, this Policy does not apply to that deployment. You are the controller for any personal data your instance processes.
13. Changes
We may update this Policy. The current version is published at bast.sh/legal/privacy. Material changes may be notified by email or in the product where appropriate.
14. Complaints
Contact us first if you have a concern. You may also lodge a complaint with the Information Commissioner’s Office: ico.org.uk.
15. Contact
Privacy: [email protected]
Terms: Terms of Service
ELLIPSE SOFTWARE GROUP LIMITED
4th Floor Silverstream House, 45 Fitzroy Street, London, W1T 6EB, United Kingdom