{% extends "base.html" %}
{% block title %}Privacy{% endblock %}
{% block description %}What data the AIM service processes, why, for how long, and what rights you have.{% endblock %}
{% block body %}

<h1>Privacy</h1>
<p class="lede">The short version: we need an email address so you can sign in, and we deliver your
messages. We sell nothing and track nobody.</p>
<p class="muted">Last updated 12 September 2026.</p>

{% if operator_known %}
<h2>Who processes your data</h2>
<p>{{ operator_name }}{% if operator_address %}, {{ operator_address }}{% endif %}.
Contact: <a href="mailto:{{ operator_email }}">{{ operator_email }}</a>.</p>
{% else %}
<p class="error">The operator has not been filled in yet in this deployment's configuration. Until
that changes, treat this page as incomplete.</p>
{% endif %}

<h2>What we store</h2>
<table>
  <tr><th>Data</th><th>Why</th><th>How long</th></tr>
  <tr><td>Handle</td><td>it is your address; the people you write to see it</td><td>until the account is deleted</td></tr>
  <tr><td>Email</td><td>signing in and password reset; never shown to other users</td><td>until the account is deleted</td></tr>
  <tr><td>Password</td><td>stored only as an argon2id hash; we never see the original</td><td>until the account is deleted</td></tr>
  <tr><td>Signing key</td><td>proves a message really came from your account</td><td>until the account is deleted</td></tr>
  <tr><td>Message content</td><td>delivery to the other side and thread history</td><td>30 days</td></tr>
  <tr><td>Who wrote to whom</td><td>enforcing permissions and abuse protection</td><td>30 days</td></tr>
  <tr><td>Server logs</td><td>operations and security; they contain your IP address</td><td>days, depending on rotation</td></tr>
</table>

<h2>Our legal basis</h2>
<p>Performance of a contract, meaning providing the service you asked for. For security measures
such as attempt limits and server logs, our legitimate interest in keeping the service from being
abused.</p>

<h2>Who else sees it</h2>
<ul>
  <li><strong>The peer you write to.</strong> They see your address, your session label and the
  content of the messages you send them. They never see your email.</li>
  <li><strong>Cloudflare.</strong> The forms are protected by Turnstile, which checks that you are
  human. In doing so Cloudflare processes your IP address and basic browser signals.</li>
  <li><strong>Our email provider</strong>, which carries the confirmation messages.</li>
</ul>
<p>Nobody else. We do not sell data and we do not use it for advertising.</p>

<h2>Encryption and access to content</h2>
<p>Connections always use HTTPS. For password accounts the server holds the signing key, so the
operator has technical access to message content. We use it only to run the service and to deal with
reported abuse. If you would rather keep the key to yourself, use the local client.</p>

<h2>Cookies</h2>
<p>Two, both necessary: your sign-in cookie and your language choice. No analytics, no tracking, no
advertising.</p>

<h2>Your rights</h2>
<p>You may ask for access to your data, its correction, erasure, portability or restriction of
processing, and you may object to processing based on legitimate interest. Write to us
{% if operator_known %}at <a href="mailto:{{ operator_email }}">{{ operator_email }}</a>{% else %}
at the operator's contact address{% endif %} and we will deal with it without undue delay. Deleting
your account removes the email, the password hash and the keys; messages disappear on the schedule
above.</p>
<p>If you believe we are handling your data badly, you can complain to the Czech Office for Personal
Data Protection, or to the supervisory authority in your own country.</p>

<h2>Changes</h2>
<p>The service is in trial operation and this text may change. We will announce any substantial
change by email.</p>

{% endblock %}