Privacy

The website describes TDCC and runs the TDCC GPU marketplace. It collects only what the marketplace needs to work. There is no analytics, no advertising, and no tracking cookie.

Last updated October 2026Applies to decentralizedcompute.company
In shortYour email and SSH key are shown to the other side of a rental only after the host accepts. Prompts and responses sent to a rented model never pass through us. You can download or delete everything from your account settings.

Marketplace accounts

When you create an account we store your name, your email address, and a salted hash of your password (never the password itself).

  • A single session cookie keeps you signed in. It is HttpOnly, sent only over HTTPS, and expires after 30 days or when you sign out.
  • For each signed-in device we keep the browser name (user agent) and when it was last active, so you can see and sign out your devices.
  • If you turn on two-factor sign-in we store the authenticator secret and hashes of your recovery codes.
  • We keep a log of security events on your account (sign-ins, failed attempts, password and email changes) with the IP address, for up to a year, and show it to you in your settings.

Listings and requests

Listings you publish (GPU model, memory, count, region, setting, price, description) and the first word of your name are public.

Rental requests store what you enter: GPU count, hours, environment, access type, an optional SSH public key, and an optional message. Your email address and SSH key are shown to the other party only after a host accepts a request.

  • Messages you write about a rental are stored and shown to the host and renter of that rental.
  • Reviews you leave (stars, comment, and the first word of your name) are public on the host's listings. Reviews a host leaves about you are shown to hosts you send requests to.
  • If you report a problem with a rental, the report is visible to our moderators together with the rental details and both parties' names and emails.

Linked machines

If you link a TDCC node to a listing, the node reports its software version and the GPU names and memory it detects about once a minute. This is shown on the listing, together with the share of time the node was online over the last week. Check-in counts are kept for 30 days.

tdcc API rentals

If the host turns on tdcc API rentals, the node also sends its mesh invite token (its network address). It is shown only to renters whose request was accepted, while their rental lasts.

A renter who chooses tdcc API access gives their tdcc owner ID, a public-key fingerprint that the host's machine uses to admit them for the rented hours. The host's node reports how many connections the renter made, how many were turned away by the host's fair-use limit, and how long requests were open, never prompts or responses. Both sides see these numbers on the rental.

Instant machines

For instant machines, your SSH public key, chosen environment or image, GPU count, and end time are sent, signed, to the host's machine so it can start your container. The machine reports the container's state and port (and for Jupyter its access token, shown only to you). Your container and everything in it are deleted when the rental ends.

Payments

Where card payments are on, payments are processed by Stripe. We never see or store your card number; we store the Stripe identifiers of the payment and payout and the amounts charged, refunded, and paid out. Hosts set up payouts with Stripe Connect, which collects the identity and bank details required by law directly. Stripe's own privacy policy applies to the data it processes.

Emails we send

We email you only about your account:

  • a link to confirm your address, and a password reset link when you ask for one;
  • notices when a rental request is sent, accepted, declined, or cancelled;
  • when someone messages you about a rental (at most one email per conversation every 15 minutes);
  • a warning to your old address if someone asks to change your account email.

Links in these emails are single-use and expire (48 hours for confirmation, one hour for password reset). Emails are delivered through Resend, which processes your address and the message for that purpose only. If you report a listing, the report and your name and email are visible to our moderators.

Retention and deletion

You can download all data we hold about you as a JSON file, and delete your account, at any time from your account settings. Deleting removes your profile, listings, request history, messages, and reviews. Records of card payments and payouts are kept by Stripe as the law requires. Short-lived rate-limit counters keyed by IP address are kept for at most a day to stop abuse.

Server logs

The hosting provider may process standard technical logs such as IP address, browser type, timestamps, and requested pages for security and reliability. If the robot check on sign-up is on, Cloudflare Turnstile processes your browser signals to tell people from bots. Unexpected server errors may be sent to our error tracker (Sentry) with the page and error message only, without your account details or what you typed.

Contact

For privacy requests, email anil@decentralizedcompute.company.