Privacy policy

This notice explains what peckaboo.com does with personal data, who receives it, and what you can ask us to do about it. It describes the service as it actually runs. Where something is not yet settled, it says so rather than describing an intention.

Who is responsible

HYPERLINK Solutions GmbH, Ringbahnstr. 42, 12099 Berlin, Germany. Contact: [email protected], +49 (0) 30 / 398 216 398. The full details are in the imprint.

We have not appointed a data protection officer; we are below the threshold of § 38 BDSG. Requests under Articles 15 to 22 GDPR reach a person at the address above.

What peckaboo.com is, and whose data it touches

peckaboo.com monitors the Woodpecker CI servers you connect to a workspace, and shows their history, their availability and their alerts. That gives us two roles, and this notice keeps them apart:

For your account, your sign-in and our website, we are the controller. Most of this notice is about that.

For the data from your instances, we act on your behalf. Woodpecker CI writes the full name of each repository, with its owner, and the names of branches, workflows and steps into its metrics. Where a repository belongs to a person, their login is part of that name, and branch names often carry initials or logins. We process this data as a processor, under the data processing agreement an owner concludes in the workspace. The customer who connects the instance is its controller. We describe the data here anyway, so you know what happens to it.

What we hold, and why

Your account. Your name, your email address and, if you use them, a password hash, a two-factor secret and recovery codes. Your language and time zone are settings you chose. We need these to give you an account and to keep it yours. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (securing the account).

Signing in. You sign in with a link sent by email, or with your password and a code sent by email, and with two-factor sign-in set up, with your password and a second factor. We store links and codes only as hashes, and they expire. We record every sign-in in your session history: the time, the way you signed in, the IP address and the browser identifier. That is how the settings show you where your account is signed in, and let you sign out other devices. An entry is deleted 90 days after its last activity. Devices you have signed in from are remembered as a one-way fingerprint. When you sign in from a new device, we send you an email with the time, the IP address and the device, so you notice a sign-in that was not yours. Legal basis: Art. 6(1)(f) GDPR (protecting your account).

Workspaces. The name and address of a workspace, who belongs to it and with which role, and open invitations with the email address of the invited person and the name of whoever invited them. The invited person receives an email from us for that. Legal basis: Art. 6(1)(b) GDPR.

Audit log. We record who changed what in a workspace and in their account, and when, so an unexpected change can be traced. Entries are deleted after 365 days. Legal basis: Art. 6(1)(f) GDPR.

Instances and their data, on behalf of the customer. The name and address of an instance and, if given, the token of its metrics endpoint, stored encrypted and never shown again once it is saved. Every minute we ask the server of the instance for /healthz and /version, and with a token for /metrics as well, and we store what changed since the last poll: availability, version and restarts, the queue and the workers, the runs with the names of their repository and branch, and the workflows and steps with their duration and failures. Raw values are kept for 90 days; after that, daily values are kept until the instance is removed. A removed instance disappears at once, and its whole history is deleted in the background without delay. The basis is the data processing agreement with the customer.

Alerts and notifications. When an instance stops answering, has no worker, has a queue that is stuck, changes its version or restarts, we send an alert by email and to the bell of the application: always to the owners of the workspace, and to its other members if they chose to receive alerts. An alert names the instance, what happened and since when. Alerts are deleted 90 days after they ended. Entries in the bell are kept for 90 days after you read them, unread ones for 13 months. Legal basis: Art. 6(1)(b) GDPR.

Support access. When somebody needs help, our support can sign in as their account to see what they see. That requires a stated reason, it is recorded with the reason and the time in the audit log, and the account receives an email about it at the end. During such an access, support cannot reach the consents, the data export or the sign-in history, cannot agree to a changed version of the legal texts on the person's behalf, cannot conclude the data processing agreement for a workspace, and cannot delete an account. Legal basis: Art. 6(1)(b) and (f) GDPR.

Feedback. When you send a report through the feedback field while signed in, it goes by email to [email protected]: your text, a picture of the visible part of the page, its address without query parameters, its title and the page you came from, details about your browser and screen (browser identifier, window and screen size, language, time zone, operating system, light or dark color scheme), and your name and email address so we can reply. Legal basis: Art. 6(1)(f) GDPR (fixing errors, improving the service).

Errors and performance. When an error occurs in the application, a report goes to Sentry and to Flare: the identifier of your account, your IP address, the request with its secret values masked, and the trace of the error. Nightwatch receives the same details with the timings of requests, queries and jobs, to monitor performance. Legal basis: Art. 6(1)(f) GDPR (running a stable service).

Records of consent. When you accept the terms of service, acknowledge this notice, or an owner concludes the data processing agreement, we store the fact, the document version and the time in a tamper-evident ledger. That record exists so we can prove what was shown and accepted; Art. 7(1) GDPR requires it of us, and Art. 28(9) GDPR for the agreement.

Cookies

peckaboo.com sets no tracking cookies and shows no cookie banner, and those two facts belong together. It sets the cookies that keep you signed in and protect forms against cross-site request forgery, one that tells your devices apart in your sign-in history, and, only once you ask for it, cookies and browser entries that keep a setting you chose. The cookie policy lists each of them with its purpose and lifetime. All of them are strictly necessary within the meaning of § 25(2) TDDDG, which is why no consent is asked for them.

Usage analytics

We measure page views with Matomo, on a server of our own in Germany, from the request that has already happened. No script runs in your browser for it, nothing is stored on your device, your IP address is shortened, and no third party is involved. If your browser sends "Do Not Track" or "Global Privacy Control", we do not measure the request. Beyond that, you can object to the measurement by email to [email protected]. Legal basis: Art. 6(1)(f) GDPR (knowing which pages are read).

Protection against bots

Cloudflare Turnstile, in its invisible mode, protects the forms that create an account, check a password or send an email against automated requests: registering, signing in with a password or a link, and "Forgot your password?". For that, Cloudflare checks signals from your browser and your IP address, without asking you to solve a puzzle. What Cloudflare processes in doing so is described in Cloudflare's Turnstile Privacy Addendum. Legal basis: Art. 6(1)(f) GDPR (protecting the service and its accounts against abuse).

Who receives data

The table below follows a single machine-readable register in this application, so it and our record of processing activities cannot drift apart.

Recipients you choose are not in this table. An alert goes to the email addresses of the members of the workspace, and an invitation to the address a member enters.

Transfers to the United States rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework: Laravel Holdings Inc., Cloudflare, Inc. and DigitalOcean, LLC, which stores Flare's error reports for Facade BV, have self-certified under it, as their own privacy notices state. Cloudflare additionally agrees to the European Commission's standard contractual clauses.

How long we keep things

Your account: as long as you have it. If you are the last owner of a workspace, you can delete your account only after you have handed the owner role to another member.

The owners of a workspace delete it with a grace period of 30 days. During that time an owner can restore it and export its data; after that, the workspace and everything in it is deleted for good. A removed instance disappears at once, and its history is deleted in the background without delay.

The other periods are stated above, next to the data they apply to. Records of consent are kept as long as we may need to prove them; that outlasts the account itself, which is exactly what they are for.

Backups: every night, a copy of the database is stored with DigitalOcean in Frankfurt. Each copy is kept for 7 days, then one per day for 16 days, one per week for 8 weeks, one per month for 4 months and one per year for 2 years. Older copies are deleted. What has been deleted disappears from copies that already exist only on this schedule.

Your rights

You can ask us for a copy of your data (Art. 15), its correction (Art. 16), its erasure (Art. 17), a restriction of its processing (Art. 18), its delivery in a portable format (Art. 20), and you can object to processing we base on legitimate interests (Art. 21). peckaboo.com produces your data as a file in the settings, and the owners of a workspace can export its data.

For the data from the instances of a workspace, turn to the customer who connected them first; they are its controller, and we help them answer your request.

You can also lodge a complaint with a supervisory authority. The one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.

Changes to this notice

Every change gets a version number. A change that affects you materially is announced, not rolled out silently.