Privacy Policy
This policy explains what this website (https://apsi.dev) stores about you, why, and what you can do about it. The site is operated by ATEC.
What we store
| Data | Why | Who can see it |
|---|---|---|
| E-mail address | Signing in and password resets | Nobody else. It is never shown on the site, in feeds or in the API, and it is stored encrypted. |
| Password | Signing in | Nobody. Only a salted scrypt hash is stored. |
| Public name, profile text | Shown with your posts, comments and libraries | Everyone |
| Posts, comments, images, videos, likes | The community | Everyone (likes are shown as counts) |
| Libraries you publish | The registry | Everyone |
| API tokens | Publishing libraries | Nobody. Only a SHA-256 hash and the first characters are stored; the full token is shown to you once. |
| Two-factor secret | Two-factor sign-in, if you turn it on | Nobody else (stored encrypted) |
| Sessions (device description, time) | Keeping you signed in; showing you your signed-in devices | Only you |
| Reports you send | Fixing problems | Only the maintainers |
| Security log (actions such as sign-in, token creation, publishing) | Protecting accounts and investigating abuse | Only the maintainers |
Service providers
The site is delivered through Cloudflare, which handles every connection to protect the site against attacks and to speed it up. Cloudflare therefore processes technical connection data such as your IP address and browser type on our behalf; see Cloudflare's privacy policy. No other company receives your data, except Google if you choose “Continue with Google”, and an e-mail provider when the site sends you a password-reset message.
What we do not do
- We do not sell or share personal data.
- We do not use advertising or third-party tracking, analytics or social-media scripts. All fonts, scripts and styles are served from this site.
- We remove location and camera metadata (EXIF) from JPEG and PNG images when you upload them.
- IP addresses are used in memory for rate limiting and are not stored in the database.
Cookies
The site uses only cookies that are needed for it to work:
- a session cookie that keeps you signed in (HttpOnly, Secure, SameSite=Lax);
- a short-lived cookie that protects forms against cross-site request forgery;
- if you sign in with Google, a short-lived cookie that protects that sign-in;
- your light or dark theme choice, stored in your browser’s local storage (never sent to the server).
Signing in with Google
If you choose “Continue with Google”, Google tells us your verified e-mail address and an account identifier. We do not receive your Google password or contacts.
How long we keep data
- Your account data is kept until you delete your account.
- When you delete your account, your e-mail address, password hash, sessions, tokens, posts and comments are deleted. Library versions you published stay available, shown as owned by “deleted”, so that projects that depend on them keep working.
- Server backups may keep deleted data for up to 30 days.
Your rights
You can see and change your profile at any time, download your posts by viewing them, and delete your account in Settings → Security. For any other request about your data — including a copy of what we store — contact [email protected].
Security
Passwords are hashed with scrypt, e-mail addresses and two-factor secrets are encrypted in the database (AES-256-GCM), all traffic uses HTTPS, sessions are protected against theft and cross-site attacks, and two-factor authentication is available. See Security.
Changes
We will announce significant changes to this policy on the site.
Last updated: 8 November 2026.