Legal

Privacy Policy

Last updated September 5, 2026.

1. Overview

This Privacy Policy explains what data Cawcus ("we", "us") collects when you use our feedback board product (the "Service"), why we collect it, and which third-party providers process it on our behalf. Our servers are hosted with Hetzner in Germany, and infrastructure sits behind Cloudflare.

2. Data we collect

  • Account data — email address, username, and password hash if you register directly, or your GitHub account identifier, username, and email if you sign in with GitHub OAuth.
  • Guest identifiers — a randomly generated cookie (one year, renewed on each visit) set for unauthenticated visitors, used to attribute votes, posts, and comments consistently without an account. It also generates an automatic pseudonym (for example, "Rapid Grey Rattlesnake") shown as the author name. For guest votes we store a keyed hash of your IP address for 30 days to limit repeat voting; the raw IP address is not stored.
  • Content you submit — posts, comments, votes, board names and descriptions, and any other content submitted to a board.
  • Contact form submissions — name, email, subject, and message, when you contact us directly.
  • Technical data — IP address, request logs, and similar network metadata processed by Cloudflare as our reverse proxy and by our hosting provider for security and abuse prevention.

3. How we use your data

We use this data to operate and secure the Service: to authenticate you, display and rank board content, send transactional emails (such as password resets or contact replies), respond to support requests, prevent abuse, and, where you opt in, send product updates.

4. Third-party service providers

We rely on the following providers to run the Service. Each processes a limited slice of data necessary for its function:

  • Cloudflare — acts as a reverse proxy in front of our servers, providing DNS, CDN, and DDoS/bot protection. Cloudflare sees request metadata (IP address, headers) for all traffic to the Service.
  • Resend — sends transactional emails (account verification, password resets, notifications) and, where you've opted in, marketing emails, on our behalf.
  • Purelymail — hosts our support mailbox and sends and receives email correspondence when you contact us directly.
  • GitHub — provides OAuth sign-in. If you register or log in with GitHub, GitHub shares your public profile, username, and email address with us.
  • OpenRouter — processes board content you or your board submits to AI-assisted features (such as title generation) by routing it to an underlying AI model provider for inference.
  • Hetzner — hosts our application servers and database in Germany.

5. International transfers

Our hosting infrastructure is located in Germany (EU). Some of our providers, including GitHub, Resend, and OpenRouter, may process or route data through servers outside the EU/EEA. Where this occurs, we rely on that provider's applicable safeguards, such as standard contractual clauses, for the transfer.

6. Cookies

We use a session cookie to keep you logged in, and a guest identifier cookie (one year) so unauthenticated visitors can vote and post consistently. Cloudflare may also set cookies needed for security and performance. We don't use third-party advertising cookies.

7. Data retention

We keep account and board data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to comply with a legal obligation, resolve disputes, or enforce our agreements.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete your account and its data directly from account settings, or contact us via our contact page to exercise these rights.

9. Data security

We use reasonable technical and organizational measures, including encryption in transit and access controls, to protect your data. No method of transmission or storage is completely secure, and we can't guarantee absolute security.

10. Children's privacy

The Service is not directed at children under 16. We don't knowingly collect account data from children under that age.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the date at the top of this page.

12. Contact

Questions about this Privacy Policy or your data can be sent via our contact page.