Privacy

What we keep

• Account: your Discord user ID, Discord username, Discord display name and Discord avatar (as its hash), read with Discord's identify scope. Deleted when your account has no sessions left, or when you ask.
• Sessions: for each PC you are signed in on, at most 3: hashed session tokens, which app, and when the session was created and last used, updated about every 15 minutes while the app runs. A session expires after 30 days without use or 90 days after sign-in, and is deleted 30 days after it ends or expires.
• Web server logs on osvoid.se and api.osvoid.se: the request, status and time, and your IP address shortened to /24 (IPv4) or /48 (IPv6). Up to 8 days.
• API log: your Discord user ID when you sign in or are refused, and when a session ends. 30 days.
• Copies of the database made before an upgrade: deleted after 7 days.
• Backups of accounts and sessions: encrypted, hourly, kept up to 12 months (48 hourly, 30 daily, 12 monthly), so deleted data leaves them within 12 months.
• Crash and error reports, only if you tick Send crash and error reports, which is off until you do; the same checkbox in the app's sidebar menu turns it off. A report holds the error text, the last lines of the app's error output and the app version, with Windows user folder names removed. 30 days.

This is everything OSVoid stores about you. Every host the apps contact, and what they send: What leaves your PC.

Who processes it

• OVHcloud runs our servers in Frankfurt, Germany.
• Hetzner stores the encrypted backups in Finland.
• Sentry stores crash reports in its EU region, in Germany, without IP addresses. Sentry is a US company; its data processing agreement covers any access from the US.

Each under a data processing agreement.

Legal bases

• Accounts and sessions: contract, to give you the service you signed in for (GDPR article 6(1)(b)).
• Logs and backups: legitimate interest in security and recovery (6(1)(f)).
• Crash reports: your consent (6(1)(a)).

Your rights

You can get a copy of your data, have it corrected or deleted, restrict or object to its use, receive it in a portable form, and withdraw consent at any time. Write to privacy@osvoid.se; we answer within a month. You can complain to IMY, the Swedish privacy authority.

The controller is the OSVoid team, privacy@osvoid.se.