Privacy Policy

What this template collects by default

Account details you provide (name, email, password or OAuth identity), and — for every sign-in — device, browser, approximate location, IP address and referrer, used for the audit log under Admin → Activity Logs. See lib/request-info.ts.

Device fingerprint. A device identifier (FingerprintJS) computed in your browser from browser and device characteristics: platform, screen size, installed fonts, languages, time zone, CPU, memory, graphics (WebGL) and similar details. Large values such as canvas drawings are stored only as a hash. Accessibility settings (such as reduced motion or high contrast) are never collected. It's used to:

• email you, and the site's administrators, when your account signs in from a device it hasn't used before;
• limit repeated failed sign-in and sign-up attempts from one device;
• spot one device being used to create many accounts, which administrators may act on;
• let administrators review the devices your account signs in from, with these characteristics.

Cookies and similar technologies

Always on (necessary): sign-in session cookies, a 5-minute cookie remembering which page a sign-in started from, a cookie recording whether this site asks for consent, sidebar and theme preferences, and short-lived browser storage for sign-in retries and "what's new" notices.

Only with your consent, chosen separately for each:

• Security fingerprint: the device fingerprint described above. If you decline it, failed sign-ins are limited by IP address instead and no device record is kept.
• Google One Tap: quick sign-in with Google, which loads a Google script that may set Google's own cookies.

"Accept all" allows both, "Necessary only" neither, and "Customize" lets you pick each one; nothing is ticked in advance. Your choice is stored in a cookie for one year. If you're signed in, we also keep a record of each choice you make (what you chose, which version of this notice, and when) with your account, so we can show that consent was given.

You can change your choice at any time via "Cookie settings" in the footer. While the security fingerprint is allowed, the device identifier is also kept in your browser's local storage. Withdrawing consent for it deletes that identifier, and deletes the record of this device stored with your account (immediately if you're signed in, otherwise at your next sign-in). Withdrawing consent for Google One Tap stops it from loading and removes its cookie. If other accounts have also signed in from this browser, their records of this device are not deleted by this choice; they are deleted when those accounts are deleted. This stops one person's choice from erasing other accounts' security records.

Legal basis

Your consent, given separately for the security fingerprint and for Google One Tap; the performance of our contract with you for your account; and our legitimate interest in keeping accounts secure for sign-in logs and the failed-sign-in limit.

How long it's kept

• Account details, sign-in logs and device records: until your account is deleted. Device records are also deleted when you withdraw consent for the security fingerprint.
• Failed sign-in counters (device identifier, IP address, browser and the last email entered): 30 days after the last attempt.
• Sessions: up to 30 days, or until you sign out or revoke them.
• Records of your cookie choices: until your account is deleted.

Where it's stored and who receives it

In your own Postgres database, via the schema in server/db/schema.ts. The device fingerprint is computed locally in your browser and isn't sent to FingerprintJS. When enabled, these services receive data to do their job: an email provider (Resend) receives your email address and the content of account emails, such as new-device alerts with the device, approximate location and IP address; Google receives sign-in requests if you use Google sign-in or One Tap.

Your rights

You can delete your account yourself from your dashboard settings, which deletes your account details, sessions, sign-in logs and device records. You can withdraw cookie consent at any time via "Cookie settings" in the footer. For a copy of your data, or any other request, contact the site's operator.

Your obligations

If you collect personal data from real users, you're responsible for disclosing that accurately here and complying with the privacy laws that apply to you. Turning off "Require consent" in System Settings is only appropriate if none of your users are in the EU, the UK or another region with consent rules.