Privacy Policy

1. Who is responsible

1.1. The controller of your personal data (in Brazil, the "controlador") is Júlia Klee (Kleedolinux), who runs WolOS.org and WolOS Hub from São Paulo, Brazil.

1.2. Contact for everything about your data: julia@wolos.org.

1.3. Data protection officer and, in Brazil, "encarregado pelo tratamento de dados pessoais": Júlia Klee, julia@wolos.org.

1.4. This policy covers WolOS Hub at hub.wolos.org (the "hub"). Words such as "hub", "account", "publisher", "Work" and "public log" have the meanings in the Terms of Use, section 2.

1.5. This policy follows the EU General Data Protection Regulation (GDPR), Brazil's Lei Geral de Proteção de Dados (LGPD, Lei 13.709/2018), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and the privacy laws of other US states. Where they differ, we follow the one that protects you more.

1.6. Legal representative in the EU (GDPR, article 27): to be appointed; until then contact the controller directly at julia@wolos.org.

1.7. Address: São Paulo, Brazil, full address on request.

2. What we never do

• We never sell your personal data, and we never share it for advertising.
• We show no advertising and use no analytics, tracking pixels, fingerprinting or third-party scripts.
• We never ask for your password, your signing keys, your ID documents, or any sensitive data (health, beliefs, ethnicity, sex life, biometrics, precise location).
• We never build profiles of you, and we never make decisions about you with legal effect by machine alone.

3. What we keep

We keep exactly these categories. Nothing else.

3.1. Your GitHub account, as GitHub gives it to us when you sign in: your numeric GitHub id, login, display name and avatar address. With them, two facts GitHub reports about the account: when it was created, and whether two-factor sign-in is on.

3.2. Your organisation memberships: the GitHub organisations GitHub says you belong to, and your role in them.

3.3. Your acceptances: which texts you accepted (Contributor Licence Agreement, Terms of Use, Publisher Agreement, Trust Terms), which version, the hash of the exact text, and the time.

3.4. Listings and releases: the metadata of what you publish: names, summaries, licences, versions, repository addresses, release addresses, file hashes, sizes, icons and screenshots, and the hub's check results.

3.5. Reports: reports you send (the listing, the reason, your text) and the moderator's decision.

3.6. Certificate requests and Certificates: your request (subject, level, public key, the rules checked at the time and their values, such as account age and two-factor status), the decision, and the public Certificate.

3.7. Audit log: a record of each action that changes something on the hub: who did it (GitHub id or system), what, on what, when, and, for actions in the admin panel, an address class: whether the connection was IPv4 or IPv6 and the country it came from. We do not store your IP address in the audit log.

3.8. Webhook delivery ids: the ids GitHub gives to the messages it sends us about repositories, so we do not handle the same message twice.

3.9. Rate counters: counts of requests per minute or per day, per account or per network address, used to stop floods and abuse. A counter's key contains the network address only for the per-address limits. This is the only place where the hub stores an IP address, and only for at most 2 days.

3.10. Session cookie: one cookie in your browser, described in section 12 and in the Cookie Notice. It holds your GitHub id and login and your GitHub sign-in token, sealed with encryption so only the hub can read it. The hub keeps no copy of the token.

3.11. Messages you send us by email (for example a privacy request or a notice), with your email address. We keep them only to answer and to show we answered.

4. Why we use it, and on what legal basis

GDPR article 6(1) and LGPD article 7 require a legal basis for each purpose. We use no consent-based processing, so there is nothing to withdraw; you can object instead (section 8).

• Sign you in and keep you signed in. Data: 3.1, 3.10. GDPR: 6(1)(b) contract. LGPD: 7 V contract.
• Act for organisations you belong to. Data: 3.2. GDPR: 6(1)(b) contract. LGPD: 7 V contract.
• Prove what you accepted and when. Data: 3.3. GDPR: 6(1)(f) legitimate interest (proving the agreement); 6(1)(c) where a law asks. LGPD: 7 VI exercise of rights; 7 IX legitimate interest.
• List, check and publish your Work; sign the index. Data: 3.4. GDPR: 6(1)(b) contract. LGPD: 7 V contract.
• Show who published what and keep the public log. Data: 3.4, 3.6, 3.7. GDPR: 6(1)(f) legitimate interest (people can check what they install). LGPD: 7 IX legitimate interest.
• Handle reports and moderate. Data: 3.5, 3.7. GDPR: 6(1)(f) legitimate interest (a hub without abuse); 6(1)(c) legal obligation for notices under the EU Digital Services Act. LGPD: 7 IX legitimate interest; 7 II legal obligation.
• Issue, review and revoke Certificates. Data: 3.1, 3.6. GDPR: 6(1)(b) contract; 6(1)(f) legitimate interest (stopping misuse). LGPD: 7 V contract; 7 IX legitimate interest.
• Stop floods, abuse and attacks. Data: 3.7, 3.8, 3.9. GDPR: 6(1)(f) legitimate interest (keeping the hub running). LGPD: 7 IX legitimate interest.
• Answer your messages and requests. Data: 3.11. GDPR: 6(1)(c) legal obligation; 6(1)(f). LGPD: 7 II legal obligation; 7 IX.
• Defend or bring legal claims, answer authorities. Data: any, as needed. GDPR: 6(1)(c), 6(1)(f). LGPD: 7 II, 7 VI.
• Protect someone's life or physical integrity, report a suspected crime. Data: any, as needed. GDPR: 6(1)(d) vital interests; 6(1)(c) where a law asks (Digital Services Act, article 18); 6(1)(f). LGPD: 7 VII protection of life; 7 II; 7 IX.

4.1. Our legitimate interests: running a public catalogue that people can check, stopping malware and impersonation, keeping the hub available, and proving what was agreed. We weighed them against your rights: the data is small, mostly public already on GitHub, and you expect it to be used this way.

4.2. Automatic rules (two-factor, account age, rate limits, checks) decide whether a request can go ahead. They do not have legal effect on you; a person reviews any of them if you ask (Terms of Use, section 11). This also answers LGPD article 20.

5. How long we keep it

• GitHub account (3.1), memberships (3.2): while you have a hub account. Memberships are refreshed at each sign-in. Deleted within 30 days of your deletion request.
• Acceptances (3.3): while you have a hub account, then 5 years, to prove the agreement in a dispute.
• Listings and releases (3.4): while the listing exists. What entered the signed index and the public log stays there, because people use it to check what they installed.
• Reports (3.5). How long: 2 years after the decision, then deleted.
• Certificate requests (3.6). How long: 5 years after the decision. Public Certificates and revocations stay in the public record for as long as it exists.
• Audit log (3.7): as long as the hub runs. After your account is deleted, entries keep only your numeric GitHub id.
• Webhook delivery ids (3.8). How long: 30 days, deleted automatically.
• Rate counters (3.9). How long: 2 days, deleted automatically.
• Session cookie (3.10). How long: 7 days at most, or until you sign out.
• Messages to us (3.11). How long: 3 years after the last message, then deleted.

5.1. We keep data longer only when a law or a court requires it, or while a dispute about it is open.

6. Who sees it

6.1. The public. Listings, releases, check results, public Certificates, the revocation list and the public log are public. They show GitHub logins and ids, because that is how people know who published what. Reports and the names of people who report are never public.

6.2. Our moderators and reviewers, under a duty of confidentiality, only for what their role needs.

6.3. Our processors, who run the hub's machines for us under data processing contracts:

• Cloudflare, Inc. (United States, and its data centres worldwide): hosting of the pages, the hub's code, its database and key-value store, and delivery of the cookie.
• GitHub, Inc. (United States): automated jobs (GitHub Actions) and repositories that hold the signed index, the public log and the revocation list.

6.4. GitHub as its own controller. When you sign in, GitHub handles your GitHub account under its own privacy statement. We receive only what section 3.1 and 3.2 list.

6.5. Authorities and courts: when a law or a valid order requires it, after checking that the request is valid; and, without an order, only where the law allows it: to protect someone's life or physical integrity, to report a suspected crime that threatens them, or to establish, exercise or defend legal claims. We give only what is needed. We tell you, unless the law, the order or the risk forbids it, and then as soon as that reason ends.

6.6. A successor, if someone takes over the hub. They must keep this policy or give you notice under section 17.

7. International transfers

7.1. The operator is in Brazil. Our processors are in the United States and run data centres in many countries. So your data leaves the country where you live.

7.2. From the EU and the EEA: to Brazil and to processors abroad, under the European Commission's standard contractual clauses (GDPR article 46(2)(c)) that are part of our processors' data processing terms, and, for US processors certified under the EU-US Data Privacy Framework, under the Commission's adequacy decision (GDPR article 45). Where neither applies, a transfer is made only when it is needed to give you the service you asked for (GDPR article 49(1)(b)).

7.3. From Brazil: under LGPD article 33, II (contractual guarantees, including standard contractual clauses) and article 33, IX (when needed to perform the contract with you, article 7, V).

7.4. You can ask us for a copy of the safeguards: julia@wolos.org.

8. Your rights

8.1. Everyone, wherever you live, has these rights with us:

• Know and access: confirm that we hold your data and get a copy.
• Correct: fix data that is wrong or incomplete. Most of it comes from GitHub: change it there and sign in again.
• Delete: ask us to delete your data. We delete it, except what the public log and the revocation list must keep and what a law requires us to keep (section 5).
• Portability: get your data in a common machine-readable format.
• Object to processing based on legitimate interest (GDPR article 21). We stop unless we have strong reasons that override yours, or need it for legal claims.
• Restrict: ask us to pause using data while a question about it is open.
• Information about who we share with (section 6), and about the effects of not giving data: without a GitHub account you cannot sign in.
• Review of automatic decisions by a person (section 4.2).
• No discrimination: using a right never costs you anything and never changes how the hub treats you.

8.2. In the EU and the EEA, these rights come from GDPR articles 15 to 22. You can also complain to the data protection authority where you live or work (GDPR article 77).

8.3. In Brazil, these rights come from LGPD article 18, including anonymisation, blocking and deletion of data that is unnecessary or excessive, and information about sharing. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

8.4. In California and other US states, see section 11.

8.5. Limits the law sets on these rights. We apply a limit only where the law that protects you allows it, and we tell you which one we rely on:

• we keep data we must keep by law, or need to establish, exercise or defend legal claims (GDPR article 17(3)(b) and (e); LGPD article 16, I; CCPA section 1798.105(d));
• we do not give you data that would reveal another person, such as the name of someone who reported you (GDPR article 15(4); in Brazil, the reporter's own rights under the LGPD);
• we may go on using data after an objection where we have compelling legitimate grounds, or need it for legal claims (GDPR article 21(1));
• we do not need to keep or collect extra data only to identify you for a request (GDPR article 11);
• entries already in the public log and the revocation list stay, because they protect everyone who installed something; after a deletion we reduce them to your numeric GitHub id.

9. How to use your rights

9.1. Write to julia@wolos.org from the email linked to your GitHub account, or write from any address and tell us your GitHub login. To confirm it is you, we may ask you to sign in to the hub or to post a short code in a place only your account controls. We never ask for ID documents.

9.2. An authorised agent may act for you, with your signed permission; we may confirm with you directly.

9.3. Response times: we confirm right away that we received your request and answer in full within 15 days. If a request is complex, we tell you within those 15 days why we need more time, and we never take longer than the law where you live allows (GDPR: 3 months in total; CCPA: 90 days in total).

9.4. Answers are free. If requests are clearly unfounded or excessive, for example because they repeat, we may refuse and explain why, or, where the law allows (GDPR article 12(5); CCPA section 1798.145), charge a reasonable fee. In Brazil, answers are always free (LGPD article 18, §5).

9.5. If we refuse, we tell you why. You can ask us to look again (an appeal) by answering our message within 60 days; we answer the appeal within 45 days and tell you how to complain to the authority where you live.

10. Complaints

10.1. Please write to us first: julia@wolos.org.

10.2. You can always complain to an authority: in the EU, your data protection authority; in Brazil, the ANPD (gov.br/anpd); in California, the California Privacy Protection Agency or the Attorney General; in other US states, the state Attorney General.

11. California and other US states

11.1. Notice at collection. The categories of personal information we collect are: identifiers (GitHub id, login, display name, avatar address; the network address, for 2 days, in rate counters), account records (acceptances, listings, releases, reports, Certificate requests), internet activity on the hub (the audit log), and approximate location at country level for admin panel actions. We collect them from you and from GitHub, for the purposes in section 4, and keep them as in section 5.

11.2. Sensitive personal information. We collect none, and we never use any personal information to infer characteristics about you.

11.3. We do not sell or share your personal information as the CCPA defines "sell" and "share", and we have not done so in the last 12 months. We have no actual knowledge of selling or sharing data of anyone under 16. So there is no "Do Not Sell or Share My Personal Information" choice to make: the answer is always no. For the same reason there is no "Limit the Use of My Sensitive Personal Information" choice: we use none.

11.4. Opt-out signals. We honour Global Privacy Control and similar opt-out preference signals. Because we never sell or share, the signal changes nothing; we still treat it as a valid opt-out.

11.5. Do Not Track. We do not track you across sites or over time on other services, so a Do Not Track signal changes nothing. No other party collects data about your activity on the hub (California Business and Professions Code section 22575).

11.6. Shine the Light. We do not share personal information with anyone for their direct marketing (California Civil Code section 1798.83).

11.7. Your rights under the CCPA (Civil Code sections 1798.100 to 1798.125): to know, access, correct and delete, to opt out of selling and sharing, and not to be discriminated against for using them. We answer within 45 days, extended once by 45 days where needed, with notice. Section 9 explains how.

11.8. Residents of Virginia, Colorado, Connecticut, Texas and other states with privacy laws have the same rights in practice: access, correction, deletion, portability, opt-out of sale, targeted advertising and profiling (none happens), and the right to appeal a refusal (section 9.5).

11.9. In the last 12 months we disclosed the categories in 11.1 only to the processors in section 6.3, for running the hub.

12. Cookies

12.1. The hub sets one cookie: the session cookie. It is strictly necessary to keep you signed in, so it needs no consent. It lasts 7 days at most, is sent only to hub.wolos.org over encrypted connections, and cannot be read by scripts on the page (HttpOnly).

12.2. During sign-in, a second short cookie may hold the sign-in state for at most 10 minutes, so the hub can match GitHub's answer to your request. It is deleted when sign-in ends.

12.3. The pages may keep your chosen colour theme in your browser's local storage. It never leaves your device.

12.4. No analytics, advertising or third-party cookies. The Cookie Notice has the details.

13. Data protection officer and encarregado

Júlia Klee is the data protection officer and the encarregado. Write to julia@wolos.org. She takes complaints and questions from you and from authorities, and makes sure they are answered.

14. Children

14.1. The hub is for people 16 or older. We do not knowingly collect data from anyone under 16, and the hub is not directed to children.

14.2. If we learn that a hub account belongs to someone under 16, we close it and delete its data within 30 days, except what the public log must keep, which we reduce to the numeric GitHub id. Parents or guardians can write to julia@wolos.org.

15. How we protect your data

• Connections to the hub are always encrypted.
• Your GitHub sign-in token travels only inside your cookie, encrypted so only the hub can read it, and the cookie is signed so nobody can change it.
• We store no passwords, no signing keys and, apart from rate counters, no IP addresses.
• The admin panel is closed: it answers like a missing page to anyone without a role. Roles have only the rights they need. Every action is in the audit log. Revoking a Certificate for abuse needs two people.
• The signing keys of the hub's index and of the Certificate authority are not on the hub's web servers.
• We keep the data in section 3 and nothing more, and delete it on time (section 5).
• Our processors are bound by data processing contracts and their own protection programmes.

These measures fit the risk of the small amount of data we hold (GDPR article 32; LGPD article 46). No system is perfect, and no measure can rule out every attack. If something goes wrong, section 16 applies.

16. If there is a breach

16.1. If a breach of personal data may put you at risk, we:

• tell the competent data protection authorities within 72 hours of learning of it (GDPR article 33), and the ANPD within 3 working days (LGPD article 48 and ANPD rules);
• tell you within 3 working days, or sooner when a law asks for it, in plain words: what happened, what data, what we did, what you can do;
• follow the notice rules of US states where they apply to you.

16.2. We keep a record of every breach, even small ones.

17. Changes to this policy

We change this policy only by a new version, listed in the Changes Log. For a change that matters to you, we tell you at least 30 days before it takes effect, on the hub and by GitHub notification or email when we have one. We never start a new use of your data without telling you first and, where the law asks for it, getting your consent.

18. Contact

Controller and designated contact: Júlia Klee, julia@wolos.org. Address: São Paulo, Brazil, full address on request. Legal representative in the EU: to be appointed; until then contact the controller directly. You may write in English or Portuguese.