Privacy

Controller

[Company name], [registered office], [privacy email].

What we process

• Server logs (IP address, date, requested page, browser) kept by the hosting provider for security for up to [14] days.
• Reports you send us by email: we use them only to handle the report and keep them for [24] months.

Cookies and local storage

Visitors who do not sign in get no cookies. If you choose a light or dark appearance, the choice is saved only in your browser (local storage) and never sent to us. The “Get” button detects your operating system inside your browser to suggest the right install channel; nothing is sent.

Developer accounts

Only if you sign in to publish a listing. Legal basis: performance of the service you request (art. 6(1)(b) GDPR); security logs: legitimate interest (art. 6(1)(f)). [(A) to be checked by a lawyer: legal bases and retention periods]

• From GitHub or Google we receive only: account id, username, display name, email (if the provider shares it, with its verified flag) and avatar address. We do not ask for access to your private repositories or to your email.
• A technical session cookie (bam_session), strictly necessary, valid up to 30 days and ended after 7 days of inactivity or when you sign out. During sign-in a short-lived cookie (bam_oauth, 10 minutes) protects against forged requests. No consent is needed for these cookies.
• If you sign in with GitHub, the access token GitHub gives us is kept encrypted only inside the session, to check your repository permissions, and is deleted when the session ends.
• Your listings, uploaded images, review messages and notifications, kept as long as the account exists.
• A security and review log (what action, when, on which listing) without names or emails; after account deletion only an anonymous id remains, kept for [24] months for disputes. IP addresses are used only in memory to limit abuse and are not stored by us.
• Deletion: from the Account page you can delete everything at once; data is removed right away, backups are overwritten within [30] days.

Login providers

Sign-in goes through GitHub (GitHub, Inc., USA) or Google (Google Ireland Ltd / Google LLC). Their own privacy policies apply to what you do on their pages. [(A) to be checked by a lawyer: transfers outside the EU and safeguards]

Recipients

Hosting provider [..] (EU). No transfers outside the EU [to be confirmed].

Your rights

Access, rectification, erasure, restriction, portability, objection; complaint to the Italian data protection authority (Garante). Write to [privacy email].