# Privacy Policy Effective date: [DATE] ## 1. Who operates the Service Sinlab Forgejo at https://code.sinlab.org (the “Service”) is operated by SinLabaratory Montenegro. Where applicable data protection law uses the term “controller,” this Operator is the controller of personal data processed to operate the Service. Privacy contact: valor.vl@gmail.com. ## 2. Information processed Depending on the features you use, the Service processes: - Account information, such as your username, email address, profile details, authentication records, and public SSH keys. - Content you submit, including repositories, commits, issues, pull requests, comments, attachments, and associated metadata. Git commits may contain author names and email addresses. - Technical information, such as IP addresses, request timestamps, browser information, and security and application logs. - Essential cookies and similar storage used for authentication, sessions, and security. If Google sign-in is enabled and you use it, the Service receives identity information authorized through that sign-in process, which may include your Google account identifier, name, email address, and profile image. Your Google password is not provided to the Service. ## 3. Purposes and legal bases Information is processed to provide accounts and collaboration features, authenticate users, send requested or operational messages, maintain security, prevent abuse, investigate failures, and comply with legal obligations. Where GDPR or similar requirements apply, the relevant legal bases are performance of the service agreement, legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where required. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Information necessary to provide an account or feature must be supplied to use that account or feature. ## 4. Visibility and confidentiality Public repositories and other public contributions can be viewed without an account and may be indexed or copied by third parties. Private content is subject to access controls, but authorized administrators and service providers may access it where necessary for operation, support, security, or legal compliance. No system can guarantee absolute security or confidentiality. Do not upload credentials or information you are not authorized to disclose. This statement does not waive the Operator’s legal obligations or your statutory rights. ## 5. Recipients and external providers Personal data may be disclosed to authorized service providers where necessary to operate the Service, and to authorities or other parties where legally required. Hosting and backup providers: hetzner.com. Email provider: Google. Email delivery involves processing recipient addresses and message contents. If you use Google sign-in, Google processes information under its own privacy policy. Other integrations you enable may disclose information to their respective providers. Where international transfers require legal safeguards, the applicable safeguards are: No transfered. ## 6. Retention and deletion Account information is retained every week. Technical and security logs are retained 24h. Deleted information may remain in backups for 1 moth before those backups expire. Content may be retained longer where required by law or necessary for legal claims. Contact the Operator to request account or data deletion. Copies in third-party clones, forks, caches, or archives are outside the Operator’s control. ## 7. Your rights Depending on applicable law, you may have rights to access, correct, delete, or obtain a copy of your personal data; restrict or object to processing; and withdraw consent where processing relies on consent. Send requests to valor.vl@gmail.com. Proportionate identity verification may be required. You may also complain to the competent data protection authority where applicable. ## 8. Changes This Policy may be updated to reflect changes in the Service or its processing practices. Material changes will be communicated appropriately, and additional consent will be requested where required by law. Nothing in this Policy excludes mandatory privacy or data protection rights.