Privacy Notice

Last updated: 15 October 2026

1. Controller

Nicky Reinert
Enable JavaScript to see the email address.

("we", "us", "our")

2. Scope

This notice describes how we process personal data when you visit and use our platform hosted at cr34te.it. It applies to all visitors, signed-in users, reporters, and submitters.

3. Hosting and Infrastructure

Our platform relies on the following providers. Depending on the service and processing, they may process personal data on our behalf or for their own purposes:

Cloudflare Web Analytics is enabled. It collects anonymised visitor metrics (page views, referrers, country) without setting cookies or storing individual IP addresses in its analytics product. We do not combine Cloudflare analytics data with the platform data described below.

Data transfers to the United States are based on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) and/or Standard Contractual Clauses.

4. Data We Process and Why

4.1 Network-address data (keyed hash)

For rate limiting, visitor counting, abuse prevention, and engagement metrics we compute an HMAC-SHA256 keyed hash of your IP address (IPv4: full address; IPv6: /64 prefix) using a server-side secret. The raw IP address is not stored in application tables except where explicitly stated below (submissions, admin lockout). The keyed hash is pseudonymous: we hold the key.

Purposes and retention:

• Claim rate limiting – keyed hash and timestamp of each claim; retained 1 hour.
• Visitor counting – keyed hash per UTC hour; retained 2 days.
• Engagement metrics – keyed hash in per-version, per-day view rows and per-hour budget rows; sent only after you press "Confirm" in the welcome dialog; retained 2 days. If you press "Decline", only an anonymous daily counter is incremented (no hash, no address). If you make no choice, nothing is sent and the dialog reappears on your next visit.
• Penalty records – keyed hash associated with strikes, cooldowns, and bans; retained 90 days after the last change; bans persist until cleared by the operator.
• Reports – keyed hash of every reporter (signed in or not); retained 90 days.
• Push subscriptions – keyed hash; retained 90 days without a visit or until you turn off notifications.
• Email confirmation log – keyed hash of the network address per confirmation email (no email address in this log); retained 1–2 days.

4.2 Browser ID

On your first claim or report, the client-side controller creates a random 256-bit identifier stored in your browser's local storage (cr34te-browser-id). It is sent with subsequent claims and reports. We store only the keyed HMAC-SHA256 hash of this ID, never the raw value.

Purpose: abuse prevention – penalties follow a browser across networks; report deduplication does not treat one browser as multiple reporters.

Legal basis: necessary for the performance of the claim or report you request (Art. 6(1)(b) GDPR). No separate consent is required.

Retention: with the ticket or report (90 days); penalty records 90 days after the last change; bans until cleared. The raw ID remains in your local storage until you clear site data.

4.3 Claims and tickets

When you request a turn (POST /api/v1/leases), we store:

• Ticket token hash, status, base commit, timestamps
• Requester: your account ID (signed in) or the keyed network hash (anonymous)
• Browser hash: the keyed browser hash when a browser ID is present

Purpose: run the queue; attribute penalties after rejected changes or revoked versions; link a browser to accounts that claimed from it.

Retention: requester and browser hash cleared after 90 days; tickets deleted together with their payment records.

4.4 Submissions (patches)

When you submit a patch we store:

• The patch content, every moderation-stage verdict, model inputs and answers, resulting commit
• Linkage to the originating ticket and its requester
• The full IP address of the submitting request in client_ip (your browser's address if you submit here, or potentially the coding agent's network address if it submits for you)

Purpose: explain moderation decisions and handle disputes. The IP address may be disclosed to hosting providers or law-enforcement authorities to follow up on abuse.

Retention: tickets and submissions 90 days; the IP address is cleared after 30 days or sooner if the configured general retention period is shorter.

4.5 Reports

When you file a report (POST /api/v1/reports) we store:

• Version, reason, statement, your email address, optional name, timestamp, outcome
• Your identity: account ID (signed in) or ip: + keyed network hash (anonymous)
• Keyed network hash of every reporter
• Keyed browser hash when a browser ID is present

Purpose: operator review; one outcome email to you; deduplication (one report per identity and version; automatic revocation counts a report only when both network and browser are new for that version).

Retention: 90 days.

Operator notification: the report reason and statement (without your email, name, or identifier) are forwarded via Cloudflare Email Routing to the operator's mailbox. The mailbox is retained at the operator's discretion; the forwarding address exists until removed in settings.

Appeals: if you appeal a rejected submission (POST /api/v1/reports with the reason appeal), we store the submission ID, your explanation, your email address, optional name, the keyed network and browser hashes, the operator's decision and written reason, who decided and when, and the emails we send you about the decision and its release. The ticket token you send as proof is compared with the stored hash and is not stored again. We email you about the decision, and about the result if the submission is released. These emails are not a subscription. The operator receives your explanation without your email address. Retention: 90 days (the general retention period); the rejected submission is kept while an appeal on it is pending.

4.6 Votes

One vote per account per version. We store account ID, version, vote value, and timestamp of last change.

Retention: 90 days after the last change.

4.7 Sign-in and sessions

We support sign-in via GitHub and Google OAuth. We store:

• Provider account number (github:<id> / google:<sub>)
• Session token hashes, sign-in state hash, PKCE verifier
• A sign-in nonce that binds a returning session to the browser tab that initiated it

Retention: sign-in states deleted on use or after 10 minutes to 1 day; sessions 30 days; account record 90 days after last sign-in.

4.8 Push notifications

If you subscribe, we store:

• Browser push endpoint, hashed subscription token, keyed network hash, timestamps, delivery progress
• Maximum 10 subscriptions per network; 10 000 total

Retention: 90 days without a visit, or until you disable notifications.

4.9 Email notifications

Signed-in visitors can opt in to notification emails (double opt-in). We store:

• Account ID, email address, topics, request/confirmation/last-send timestamps
• Confirmation and unsubscribe token hashes
• Per confirmation email: account ID, keyed network hash, send time

Retention: unconfirmed subscriptions 48 hours; confirmed until you unsubscribe or the account record is deleted (90 days after last sign-in); send log 1–2 days.

4.10 Payments (Fast Passes / Feature Freezes)

Payments are processed via Stripe. We store:

• Stripe Checkout session ID, payment intent ID, amount, currency, status, ticket ID
• No card data is stored on our side

Stripe retains its own payment records under its privacy policy.

Retention: 90 days, deleted with the associated ticket.

4.11 Operator test links

When someone opens a test link (/api/v1/probe/*), we log:

• Timestamp, User-Agent, Accept header, network operator (AS number, name, country)
• No IP address

Purpose: verify that AI assistants can reach the platform.

Retention: 7 days.

4.12 Admin console

The admin console is protected by Cloudflare Access. Failed admin logins are rate-limited via an HMAC of the client IP keyed with the admin password. This data is retained for 15 minutes (lockout window) and deleted after 1 day. It is not covered by this notice beyond this mention.

4.13 Published changes

Accepted changes are committed to a public GitHub repository and version archive. They are public and are not deleted after the 90-day retention period for internal submission records.

5. Browser Storage (Client Side)

The following items are stored in your browser. No cookies are set by the platform itself.

6. Legal Bases (GDPR)

7. Data Sharing and Transfers

We do not sell or rent personal data. Data may be shared with:

• GitHub, Vercel, Cloudflare – hosting and infrastructure (see § 3)
• Stripe – payment processing (card data never touches our servers)
• GitHub / Google – OAuth sign-in (only the account identifier is stored)
• Law-enforcement or regulatory authorities – only when legally required (e.g. IP address from submissions)

Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

8. Your Rights

Under the GDPR (and equivalent national laws) you have the right to:

• Access (Art. 15) – obtain a copy of your data
• Rectification (Art. 16) – correct inaccurate data
• Erasure (Art. 17) – request deletion
• Restriction (Art. 18) – limit processing
• Data portability (Art. 20) – receive your data in a machine-readable format
• Object (Art. 21) – object to processing based on legitimate interest
• Withdraw consent (Art. 7(3)) – at any time, without affecting prior processing
• Lodge a complaint with a supervisory authority (Art. 77)

To exercise any right, contact us at Enable JavaScript to see the email address..

9. Retention Summary

10. Children

The platform is not directed at children under 16. We do not knowingly collect data from children.

11. Changes

We will update this notice when processing changes. The "Last updated" date at the top reflects the current version. Material changes will be highlighted on the platform.

12. Contact

Nicky Reinert
Enable JavaScript to see the email address.