Privacy policy

As of October 2026.

The short version

• This website sets no cookies and stores nothing in your browser (no local storage, no session storage, nothing similar).
• There is no tracking, no analytics, no advertising and no embedded content from others. Fonts, icons and scripts come from this website itself.
• Our web server does not log IP addresses or browser details.
• Cloudflare sits in front of the website and delivers it. Cloudflare necessarily sees your IP address.
• The status indicator in the header and the status page let your browser ask the official tavrn node directly whether it is working.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Hosting and server logs

The website runs on our own server in Germany. When your browser requests a page, the server writes a log line with the time, the requested address, the status code, the size of the answer and how long it took. It doesnot record your IP address, your browser's identification (user agent) or any address that Cloudflare passes on. The log lines are kept for a short time in rotating files of limited size, only to keep the server running and to find errors.

The list on the known issues page is fetched from GitHub by our server, not by your browser, and no data about you is sent to GitHub.

Legal basis: our legitimate interest in running the website securely (Art. 6 (1) (f) GDPR).

Cloudflare

All requests to this website pass through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which works for us as a processor (Art. 28 GDPR): Cloudflare encrypts the connection, protects the website against attacks and caches its files. To do that, Cloudflare processes your IP address, the request headers your browser sends (for example the browser type and language) and the address you request, and keeps its own logs for security purposes.

Cloudflare may process data in the USA. Cloudflare is certified under the EU–US Data Privacy Framework, and our agreement with Cloudflare includes the EU Standard Contractual Clauses. Cloudflare can set a strictly necessary security cookie in rare cases, for example when it shows a check against automated attacks; we do not use it for anything. Details:Cloudflare's privacy policy.

Legal basis: our legitimate interest in delivering the website quickly and protecting it (Art. 6 (1) (f) GDPR).

The status page

The status page shows whether the official tavrn node is working, and a small indicator in the header of every page shows whether it is online. To find out, your browser reads a small configuration file from this website and then connects directly to the node atapp.tavrn.org (the exact address is shown on the status page) and asks for its public status: once on every page you open, and on the status page every minute while it is open. As with every connection, the node receives your IP address and the request headers of your browser; nothing else is sent. The node is run by the same controller named above.

If the status page shows the uptime history, your browser reads it from this website, which fetches it from an uptime monitor (Uptime Kuma) that we host ourselves. The uptime monitor does not receive your IP address or the details of your browser.

Legal basis: our legitimate interest in showing the state of the service (Art. 6 (1) (f) GDPR).

The web app

"Open the web app" takes you to the web app of the official tavrn node. Signing in and chatting there is part of that node's service, which has its own privacy policy, shown in the app.

Downloads and links to GitHub

The desktop apps and other downloads are served by GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA. When you start a download, your browser connects to GitHub, andGitHub's privacy statementapplies. The links to the source code, the discussions and other pages on GitHub are ordinary links: GitHub only receives data when you follow one. This website tells browsers not to send the address of the page you came from (no referrer).

The desktop apps check for updates by asking this website which release is current for their update channel (at start and when you check by hand). The website answers with the address of the update file on GitHub, and the app then downloads it from GitHub. These requests are logged like page requests, without your IP address, and pass through Cloudflare (above); the download from GitHub is subject to GitHub's privacy statement.

Contributor agreements and GitHub contributions

If you contribute material to the public repositories of the just-tavrn organization, our CLA bot asks you to accept the contributor agreement. The controller and private contact are the same as listed above. Bug reports, questions and reviews without material to be incorporated do not require a signature.

We store your GitHub username, numeric account ID, signature date, signature comment ID, repository ID and pull request number in a private GitHub repository and its Git history. The signature comment and your contributions are public on GitHub. Authorized project maintainers use the private record to verify who granted permission to include contributions, recognize your signature across project repositories and establish the rights to distribute the resulting software.

Legal basis: our legitimate interest in documenting and verifying contribution permissions and defending legal claims (Art. 6 (1) (f) GDPR). A signature is voluntary, but without it we cannot accept material for which the agreement is required. This does not prevent you from reporting bugs or asking questions. There is no automated decision-making with legal or similarly significant effects; maintainers review contributions and can review problems with the signature check.

We keep the signature record while the associated contributions are distributed and for as long as needed to establish their licensing history or resolve legal claims. Records are reviewed when no longer needed; a deletion request is assessed against any continuing need to preserve proof of contribution permissions. Access to the private repository is limited to the maintainer and authorized maintainers administering contributions. GitHub hosts the records and runs the bot workflows; data may be processed in the USA. GitHub describes its processing and international transfer mechanisms in itsprivacy statement. We do not publish the private signature register or sell its data.

The rights and complaint options below also apply to these records. In particular, you may object to processing based on legitimate interests and contact us privately at the address above. Retaining a signature does not grant the project any rights beyond the contribution's applicable license.

E-mail

If you write to us, we use your address and your message to answer you and delete them when they are no longer needed, unless the law requires us to keep them. Legal basis: Art. 6 (1) (b) and (f) GDPR.

Your rights

Where the legal conditions apply, you have the right to

• access the personal data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• have its processing restricted (Art. 18),
• receive it in a common format (Art. 20), and
• object to processing based on our legitimate interest (Art. 21).

Since our server keeps no IP addresses, we usually cannot link a visit to you. Write to the e-mail address above for any of these requests.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.