SolidCraft Gallery

Privacy policy

Last updated: 23 October 2026

This policy explains what personal data the hosted SolidCraft Gallery instance (the “Service”) collects, why it is collected, and what choices you have. The operator of this instance is the data controller. Self-hosted copies of the software are run by their own operators under their own policies.

The Service is built to collect as little as possible. There are no advertising trackers and no third-party analytics scripts.

Data we collect

  • Account data. When you sign in with Forgejo, we receive your username, display name, avatar URL, provider account ID, and email address if your provider shares it. We do not receive your password. Email is stored for account administration and legal contact; it is never shown publicly and is not a login key.
  • Content and metadata. Project titles, descriptions, tags, license identifiers, READMEs, designs, versions, previews, measurements, repository URLs and download counts.
  • Session and security data. A hashed session token, IP address, user agent, and session creation, last-use and expiry times. Sign-in also uses a short-lived, signed OAuth cookie. Audit records cover sign-in and administrative actions. Server logs contain the request path, status, timing and a request ID, but not design contents or tokens.
  • Preferences. Your theme choice is stored in your browser under gallery-theme. It stays on your device and is not sent to us.

Cookies

  • __Host-gallery_session keeps you signed in. It is essential, HttpOnly, Secure, SameSite=Lax, and expires after 30 days or when you sign out.
  • __Host-gallery_oauth protects the sign-in round trip. It is essential, HttpOnly, Secure, SameSite=Lax, and expires after 10 minutes.

We do not use advertising, analytics or cross-site tracking cookies, and we do not embed third-party tracking pixels.

How we use data

  • To create and secure your account, sign you in, and keep your session working.
  • To host, render, index, display, search and deliver the content you publish.
  • To protect the Service, investigate abuse, and keep audit records of administrative actions.
  • To respond to support, privacy, security and legal requests.
  • To understand aggregate usage and fix bugs, using server logs rather than individual tracking.
  • To comply with legal obligations and enforce our terms of service.

We do not use your data for advertising, and we do not make automated decisions that have legal or similarly significant effects about you.

Legal bases

Where data protection law requires a legal basis, we rely on:

  • Contract: to provide the Service and your account.
  • Legitimate interests: to secure the Service, prevent abuse, keep it reliable, and understand aggregate usage. We balance these against your rights.
  • Legal obligation: to keep records or respond to lawful requests.
  • Consent: where we ask for it. You can withdraw consent at any time.

When we share data

  • Public content. Public project pages, your username, display name and avatar are visible to everyone and may be indexed by search engines. Downloads may be reused under the project’s license.
  • Forgejo. Sign-in goes through your Forgejo account, which processes the request under its own privacy policy.
  • Infrastructure providers. Hosting, database, storage and backup providers process data on our behalf under contracts that require appropriate safeguards.
  • Legal and safety. We may disclose data if required by law, or if we believe in good faith that it is necessary to protect rights, safety or the Service. Where lawful, we will try to notify the affected user.
  • No sale or rent. We do not sell, rent or trade personal data, or share it with ad networks.

Retention

We keep data only as long as needed for the purposes above. Our current schedule is:

  • Account data: while your account exists. Deletion requests are actioned after a 7-day grace period.
  • Sessions: up to 30 days; expired sessions are pruned.
  • OAuth sign-in cookie: 10 minutes.
  • Deleted projects: 30 days in soft delete, then purged along with their artifacts and repository data.
  • Server logs and job history: 30 days.
  • Audit records: 1 year.
  • Reports: 2 years.
  • Backups: kept on a rolling schedule and expire automatically. Residual copies may persist until they are overwritten.
  • Aggregated or anonymized data that cannot identify you may be kept longer.

Some content cannot be recalled: copies that others downloaded under a public license, and references in search engine caches, remain outside our control.

Security

We use HTTPS in production, store only hashed session tokens, set session cookies HttpOnly and SameSite, restrict administrative access, and render untrusted designs in a sandbox without network access. Administrative actions are audited.

No system is perfectly secure. If you find a vulnerability, report it privately through the repository or ask for a private channel first; do not test against other users’ data.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive a portable copy, and to withdraw consent. To exercise a right, contact us through the repository. We may ask you to verify your identity, for example by signing in, before acting.

We will respond within the time required by applicable law, normally within 30 days. If we cannot fulfil a request, we will explain why. You may also complain to your local data protection authority.

Children

The Service is not directed at children under 16, or the age of digital consent where you live. Do not create an account if you are below that age. If we learn that a child has created an account, we will delete it and the associated data. If you believe a child has an account, contact us.

International transfers

Data may be stored and processed in the European Union and in other countries where our providers operate. Where required, we rely on appropriate safeguards such as standard contractual clauses and the provider’s own transfer mechanisms.

Changes to this policy

We may update this policy. We will change the date above and, for material changes, post a notice on the Service. The current version always applies from its effective date.

Contact

Privacy questions and requests can be opened at github.com/kkazakov/solidcraft-gallery/issues. For personal data or security matters, ask for a private channel first; do not post personal information in a public issue.