Privacy Policy

Last updated: 31 July 2026.

I run accounts.gofranz.com, which makes me the data controller under the GDPR for everything described here. Contact details are on the imprint.

This page is meant to be readable. If something in it isn't clear, email me and I'll fix the wording.

What I collect

Account data: your email address, plus any profile details you choose to add. Your password is only ever stored as a bcrypt hash, never in readable form and never in a log.

Authentication data: active sessions, sign-in timestamps, which second factors you've enrolled (authenticator app, security key, passkey, recovery codes), and any GitHub or Google account you've linked.

Authorisation data: which applications you've granted access to, and the scopes you agreed to.

Security records: an audit log of the things worth being able to reconstruct later, meaning sign-ins, consent grants, and changes to your account. It stores a salted hash of your IP address rather than the address itself, along with your browser's user-agent string.

No analytics, no tracking pixels, no advertising, no profiling. There's nothing here to opt out of.

Cookies

Three, all strictly necessary: a session cookie and a CSRF token from the authentication layer, and forseti_locale to remember your language choice (one year, HttpOnly, SameSite=Lax). None of them follow you anywhere else, which is why you don't get a consent banner.

Why, and on what legal basis

• Creating your account, keeping it secure, and signing you in: performance of a contract, Art. 6(1)(b) GDPR.
• Letting connected applications in when you say so: Art. 6(1)(b), and Art. 6(1)(a) for the consent itself.
• Spotting and investigating abuse, and keeping the audit log: legitimate interests, Art. 6(1)(f).

How long I keep it

Account data lasts as long as your account does. Delete the account and it goes with it.

Audit records are deleted after 90 days by a job that runs nightly, so the limit is enforced rather than left to good intentions.

Where it runs, and who else sees it

The servers are Hetzner Online GmbH machines in Helsinki, Finland, so the data stays inside the EU. Outgoing mail - address verification, account recovery, org invitations - goes out through Lettermint.

If you sign in with GitHub or Google, that provider learns you signed in here and hands back your email address. At that point they're independent controllers working under their own policies, and none of it happens unless you start the sign-in yourself.

I don't sell your data, and I don't hand it to anyone else unless the law requires it.

Your rights

You can ask for a copy of your data, correct it, export it, delete it, restrict how it's processed, or object to the processing I base on legitimate interests. Most of that is already in your account settings; for anything else, email me.

If you think I'm handling your data unlawfully, you can complain to CNPD, the Portuguese supervisory authority, at https://www.cnpd.pt, or to the equivalent authority where you live.

Changes

This will change from time to time. When it changes in a way that matters, the date at the top moves and the new version goes up here.