Yes, and you could do anything else that you want with your app. However, if your application is hosted on their servers you are just a traditional user from their perspective. And as the old adage goes, if you own the server, you own the user.

There is an implicit assumption, that the code that you push is actually the same one that is being run on the VM, in your statement. This brings me back to the point I was trying to make in the parent comment.