Privacy
The site only serves administrators and public plugin browsing; visitors have no accounts and there is no per-user tracking.
What we touch
- Administrator email: used to send administrator sign-in links.
- Administrator GitHub identity: when signing in with GitHub, we read the account id, username, and verified primary email. We do not read repositories or code.
- Administrator sessions: session id, sign-in method, creation and expiry times. IP and User-Agent are stored only as hashes.
- Audit events: who set which plugin public/hidden/extended, and when, with old and new values.
- Aggregate counts: catalog/index requests and install-command copies, not linked to a person.
What we do not collect
- Visitor accounts, applications, invites, licenses, or private-registry passwords: these no longer exist in v2.
- Plugin runtime content, project files, chat or browsing history, or DSH local sessions.
- Advertising profiles, cross-site tracking, or third-party analytics scripts.
- Precise location, contacts, or other data unrelated to running the service.
How cookies are used
- First-party cookies only: the administrator session and CSRF/return-path checks during sign-in.
- The administrator session cookie is HttpOnly and SameSite; it is not used for advertising or cross-site tracking.
- Browsing catalog/detail pages needs no cookie; clearing cookies does not affect installed plugins.
Retention
- Administrator sessions: expire on expiry, sign-out, or revocation; kept briefly for security investigation.
- Audit events: kept for at most 180 days, then deleted or anonymized.
- Aggregate counts: only totals are kept; no person-level records.
- Deleting an administrator: contact the site owner via the footer. Sessions are revoked; audit records follow the previous item.
A public window is not copy protection
- Public status only controls whether a plugin appears in the catalog, detail page, and index.json; unlisting does not disable installed versions.
- All packages are publicly readable from the self-hosted registry; anyone who knows the exact package and version may still install it. That is a design boundary, not access control.
- Plugins are distributed free of charge; the site does not sell licenses or implement DRM.
Contact
For privacy questions or deletion requests, contact the administrator:
This site does not publish a support email. Use an administrator contact you already have; never send passwords or tokens over a public channel.