PRIVACY
POLICY.

The specific data we store:

• Account data. If you sign in via GitHub, we keep your GitHub username, email (if public), display name, and avatar URL. We also keep the SHA-256 hash of any API keys you generate.
• Waitlist signups. If you join the waitlist, we keep your email and the date of signup. That's it.
• Server logs. Every HTTP request gets a log line with IP, user-agent, timestamp, path, and status. We keep these for 30 days for debugging and abuse prevention, then delete them.
• Verification requests. When you use the verify tool, we log only the image reference submitted (not tied to any account unless you're signed in). We delete these logs after 30 days.

• No analytics cookies. We use Plausible for first-party page analytics, which is cookieless and doesn't fingerprint visitors.
• No Google Analytics, Segment, Amplitude, Mixpanel, Heap, PostHog, Meta pixel, or similar cross-site trackers.
• No third-party ad trackers. Ever.
• No recording of the contents of images you verify beyond the image reference itself.
• No recording of the contents of modules you pull via flareo pull — the image comes directly from the public registry. We don't sit in that path.

• Run the service. That's it. We don't sell, share, or license your data to third parties.
• Send operational emails. Waitlist confirmation, security advisories, and policy changes. We use Resend as our email provider.
• Display your identity on modules you publish (only after you submit one; during closed beta, we don't accept submissions yet).

The third parties that process your data to help us run Flareo:

You can request a copy of your data, ask us to delete it, or correct something we've got wrong by opening an issue on GitHub. We respond within 14 days and complete the action within 30 days.

If you're in the EU, you have specific rights under GDPR including the right to object to processing and the right to lodge a complaint with your local data protection authority. The same email works.

We use one cookie: a session cookie for keeping you signed in. No tracking cookies, no analytics cookies, no third- party cookies. Decline all cookies and the signed-in parts of the site won't work; everything else is unaffected.

• Server logs: 30 days, then deleted
• Verification request logs: 30 days, then deleted
• Account data: kept until you delete your account; we delete within 30 days of a delete request
• Waitlist emails: kept until you unsubscribe; one-click unsubscribe in every email we send
• Backups: 7 days for the database, then rolled off

Flareo is not directed at children under 16. If we learn we've collected data from a child, we delete it immediately.

Material changes to how we collect or use data get announced at /changelog and emailed to anyone with an account, 14 days before they take effect.

Privacy questions: GitHub Issues.