Privacy notice

1. Controller

TODO: legal entity name and registered address. Contact for privacy questions: TODO: contact email.

2. What we process

• GitHub identity: your GitHub login, name and avatar, and the organisations you belong to with your role, read from GitHub when you sign in.
• Tokens: GitHub tokens sent with registry requests are used only to ask GitHub what you can access. They are never stored or logged; caches are keyed by a hash of the token.
• Session: after signing in on this website, your GitHub token is kept only in an encrypted cookie in your browser, valid for 8 hours. Nothing is stored on our side.
• Billing: we count your organisation’s active members through GitHub, to tell whether it is on the free plan; we keep the count for up to 24 hours and not the members’ names. Stripe processes payment details; we receive the subscription status and the organisation it belongs to.
• Crates: crate files pass through the service while being published and are stored in your organisation’s own repository.

3. Cookies

One strictly necessary cookie, pc_session, holds your encrypted sign-in. This website uses no analytics or advertising cookies. Your theme choice is kept in your browser’s local storage.

4. Processors

• GitHub, which stores your crates and provides identity.
• Stripe, for payments.
• TODO: hosting provider and key management service.

5. Retention

TODO: retention periods for logs and billing records.

6. Your rights

TODO: access, correction, deletion and complaint rights, and how to exercise them.

7. International transfers

TODO: transfer mechanisms.