Your work belongs to you.

1. Who is responsible for your data?

The data controller for this workspace is K.D. Biertje. Privacy requests and questions can be sent to kdbiertje@proton.me. The controller is responsible for responding without undue delay and within applicable legal deadlines.

2. What information is processed?

• Account information: your name, email address, role, account status, and account creation date.
• Security information: a one-way scrypt password hash and random session-token hashes. The application does not store your readable password or readable session token.
• Workspace content: manuals, drafts, pictures, document metadata, and authorship information you create.
• Temporary protection data: an in-memory sign-in throttle keyed by network address and email address, retained only for the 15-minute rate-limit window.

Do not place unnecessary personal data, special-category data, or confidential third-party information in manuals or screenshots.

3. Why is it used, and on what legal basis?

Common does not use profiling, automated decision-making, advertising personalization, or marketing tracking.

4. Cookies and similar technology

The application uses only the strictly necessary common_session cookie to keep you signed in and protect private content. It lasts up to seven days, is HttpOnly and SameSite=Lax, and is marked Secure in production. It is not used for advertising or cross-site tracking.

Because this cookie is strictly necessary to provide the requested authentication service, an advertising-style consent banner is not used. No analytics, social-media, preference, or marketing cookies are installed.

5. Recipients and international transfers

The application does not sell data and does not transmit manuals or images to advertising, analytics, font, or image-processing services. Pictures are converted locally within this installation.

The operator’s hosting, backup, or infrastructure providers may process data as processors under appropriate agreements. The operator must document those providers, limit access, and assess any transfer outside the European Economic Area. Where required, appropriate safeguards such as adequacy decisions or standard contractual clauses must be used.

6. How long is information kept?

• Account and workspace content is kept while the account or workspace is active.
• Deleting an account removes its profile, credentials, favorites, and active sessions. Shared manuals and uploaded images are retained for team continuity and are attributed to “Former member” instead of the deleted account. Personal information written inside retained content or original filenames is not automatically redacted.
• Session records expire after seven days; expired sessions are removed during maintenance.
• Uploaded pictures that are not referenced by a saved manual are removed after 24 hours. Accounts are limited to 200 images or 100 MB of image storage.
• Temporary sign-in throttle entries expire after 15 minutes.
• Backup retention and deletion schedules are deployment-specific and must be documented by the operator.

7. Your GDPR rights

Subject to legal conditions, you may request access, rectification, erasure, restriction, portability, and objection. You may also withdraw consent where processing relies on consent. These rights are not absolute, but any restriction must have a valid legal basis.

• Correct: open Account & privacy in the workspace to update your name, email, or password.
• Access and portability: download a machine-readable JSON export of your account, manuals, favorites, and upload metadata.
• Erase: request account deletion from Account & privacy. Manuals and images are retained under “Former member”; contact the administrator if specific content also needs removal. The only administrator must first designate another active administrator to keep the workspace operable.
• Other requests: contact the privacy administrator to request restriction, objection, or assistance.

You also have the right to lodge a complaint with the data protection authority in your habitual residence, place of work, or the place of the alleged infringement.

8. Security and confidentiality

Controls include salted scrypt password hashing, hashed random sessions, server-enforced roles, private image delivery, login throttling, request-origin checks, security headers, upload type validation, and WebP conversion. Production deployments enable Secure cookies and HTTP Strict Transport Security.

The operator must use HTTPS, restricted production access, maintained dependencies, encrypted and tested backups where appropriate, appropriate breach-response procedures, and processor agreements. No software configuration alone can guarantee legal compliance or absolute security.

9. Audience and updates

This workspace is intended for professional and organizational use, not for children. Material changes to this notice should be dated and communicated to workspace members.

Deployment note: this notice describes the application’s implemented behavior. The controller must review it against the actual host, processors, backups, retention schedule, organization, and member jurisdictions before production use.