Privacy Policy

FireShield is developed and operated by an individual developer, reachable at moshercode@gmail.com for any question about this policy or your data. FireShield is a cloud cost protection service hosted at fireshield.dev.

When you sign in and link a Google Cloud project, FireShield requests:

• Your basic profile (email address), via standard Google Sign-In, to identify your FireShield account.
• .../auth/cloudplatformprojects.readonly: a read-only list of the Google Cloud projects you can access, so you can choose which one to link, and the project number of the one you pick. We never create, modify or delete a project.
• .../auth/cloud-billing: used once, while linking, to find the billing account of the project you chose and to grant FireShield's own service account the Billing Account Administrator role on it (see section 3).

FireShield's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

After linking, FireShield acts through its own service account, which holds the Billing Account Administrator role on your billing account. It uses that access to create and update a budget for each project you link and to run the actions you configure, including disconnecting billing if you set up a Hard Kill. You can remove this access at any time from the billing account's permissions in the Google Cloud console.

• Your account: your email address and the organization FireShield creates for it.
• Linked projects: project ID, name and number, the billing account ID, its currency, and the project's monitoring status.
• Your budget configuration: budget amount, thresholds and actions, including the destinations you enter: email addresses, Telegram chat IDs, Slack webhook URLs and your own webhook URLs. Webhook signing secrets are kept in Google Secret Manager, not in our database.
• Cost data Google sends us: for each linked project, the accumulated spend for the current period, the budget amount and the currency, as published several times a day through Google Cloud Budgets.
• Activity records: which actions ran and with what result, and a log of the changes you make to your projects and budgets.
• Feedback you submit: if you use the in-app feedback form, the message text and your account.

Your Google authorization is kept only in your browser tab's memory while you use it (never written to disk, a database or local storage) and expires on its own after about an hour. FireShield never asks Google for a long-lived refresh token. We do not store the contents of your Google Cloud projects, and we never see itemized usage: Google only sends us the accumulated total.

Solely to operate FireShield: signing you in, keeping budgets in sync with Google Cloud, tracking spend, sending the notifications and running the actions you configured, showing you your history, and reading feedback you choose to send. We do not sell your data, share it with data brokers, or use it for advertising.

• Google Cloud and Firebase: hosting, sign-in, our database, and the budget data and billing actions described above.
• Resend: delivers alert emails; receives the recipient address and the alert content.
• Telegram and Slack: receive alert messages, only when you configure them as a destination.
• Your own webhook endpoint: receives a signed request with the project ID and the reason, only when you configure a Soft Kill.

We keep your data for as long as your FireShield account exists. You can request deletion of your account and all associated records at any time by contacting us. Budgets that FireShield created in your billing account stay there until you delete them from the Google Cloud console.

All traffic to FireShield is encrypted in transit (HTTPS). FireShield never asks for or stores your Google password or a service account key. Every Soft Kill request is signed with HMAC-SHA256 so your endpoint can verify it came from FireShield.

FireShield is a developer tool not directed at children, and we do not knowingly collect data from anyone under 13.

You can revoke FireShield's sign-in access from your Google Account permissions page, and its billing access by removing its service account from your billing account. You can request access to, correction of, or deletion of your FireShield data by contacting us.

We may update this policy from time to time; the "Last updated" date above reflects the latest revision. Continued use of FireShield after a change constitutes acceptance of the updated policy.

Questions about this policy, or requests to access, correct or delete your data, can be sent to moshercode@gmail.com.