Privacy
What this app stores, why, and how to get rid of it. Written against the schema rather than from a template — if a line here is wrong, the code is what is right.
One cookie
A session cookie, set when you sign in and cleared when you sign out. It holds a random identifier and nothing else — not your address, not your name, nothing derived from them. It is httpOnly, so scripts on the page cannot read it, and SameSite=Lax, so a browser will not send it to another site. There is no tracking cookie, because there is no tracking.
What is stored
Everything below lives in this deployment’s own database and goes nowhere else.
- Your name, your email address, and your password — hashed with PBKDF2, never in a form anybody can read back.
- The organisations, projects and invitations you create, with the times they were created and changed.
- One row per signed-in device, so you can end any of them. The list names them by a hash of the session rather than by the session itself.
- An audit log of membership and invitation changes, admin-visible, which keeps the actor’s name as it was at the time — so a record still reads after the account behind it is gone.
Server logs
One line per request: a request id, the method and path, the response status, how long it took, and the organisation and account it belonged to. No page content and no field values. The identifier is echoed back to you on the response, so an error you report can be found in the log by the string you were shown.
This starter ships without a mail provider, so by default it sends nothing at all — an invitation hands the token to the admin to pass on themselves. Install a provider and invitation emails go to the address they are addressed to, and nowhere else.
Third parties
None. No analytics, no fonts or scripts from anybody else’s server, no error-reporting service unless the deployer installs one. The content security policy this app sends refuses connections to other origins outright, so the browser enforces it rather than taking anyone’s word for it.
Removing it
Closing your account deletes it, along with your sessions and memberships. It is refused while you are the only owner of an organisation with other people in it — hand that over or delete the organisation first. Audit entries stay, holding the name recorded at the time, because a log an actor can erase is not a log.
Deploying your own copy? This page describes what the code in this repository does. Change the code and this page stops being true, so read it again before you ship.