@@ -0,0 +1,273 @@
+---
+title: Privacy Policy

@@ -0,0 +48,4 @@
+
+----
+<a name="coverage"></a>
+# What this Privacy Policy covers?

@@ -0,0 +50,4 @@
+<a name="coverage"></a>
+# What this Privacy Policy covers?
+This Privacy Policy applies to all services hosted on **Disroot.org** and its sub-domains. It does not extend to any websites or web services that can be accessed from our platform including, but not limited to, any federated services and social media websites outside **Disroot**. In the specific case of the so-called federated services, and because of the very nature of the protocols they use (which has the ability to send messages, likes, share files, chat, among others features) some of the data is necessarily shared with other entities or transferred to them, therefore these interactions are out of this Privacy Policy's scope.<br>
+In any case, is important to **note that sharing data with other services providers is a user's choice** and is configured by the users in their settings per service including the decision of with whom and what to share.

@@ -0,0 +54,4 @@
+
+<a name="definitions"></a>
+## Definitions used on this Privacy Policy
+- **Data**: According to the **GDPR**, data is any information that can be used to identify a person, either directly (real name, phone number, IP address, etc.) or indirectly (any combination of the aforementioned plus device fingerprints, cookies, etc). In the specific context of the use of our platform, it is the minimum information required for the proper operation of the services provided by **Disroot.org** as well as the information the user optionally submit on any of them.

@@ -0,0 +69,4 @@
+# 1. What data do we collect?
+- Account creation requires a valid email address which is deleted from our database after the account has been approved/denied.
+- We require a username and password to identify the account holder and provide the services offered by **Disroot.org**.
+- Necessary information related to the operation and functioning of the services, which may include, for example, IP address, User Agent, etc. *More detailed information about this and how we handle it can be found in the [Per service privacy notices](#per_services).*

@@ -0,0 +70,4 @@
+- Account creation requires a valid email address which is deleted from our database after the account has been approved/denied.
+- We require a username and password to identify the account holder and provide the services offered by **Disroot.org**.
+- Necessary information related to the operation and functioning of the services, which may include, for example, IP address, User Agent, etc. *More detailed information about this and how we handle it can be found in the [Per service privacy notices](#per_services).*
+- When you make an online donation to **Disroot.org**, we only collect personal data such as, but not limited to, username (if any), country, transaction IDs or bank account/reference. The only purpose for which we use this data is administrative (verification of regular donations, accounting management) and is maintained under the same security measures described in the "How do we store your data?" section. Since all the data we collect is previously processed by a third-party payment processor such as PayPal, Patreon or Liberapay, by using these or similar services, their use of your information is based on their terms of service and policies, not ours, so we encourage you to review those policies carefully.

@@ -0,0 +71,4 @@
+- We require a username and password to identify the account holder and provide the services offered by **Disroot.org**.
+- Necessary information related to the operation and functioning of the services, which may include, for example, IP address, User Agent, etc. *More detailed information about this and how we handle it can be found in the [Per service privacy notices](#per_services).*
+- When you make an online donation to **Disroot.org**, we only collect personal data such as, but not limited to, username (if any), country, transaction IDs or bank account/reference. The only purpose for which we use this data is administrative (verification of regular donations, accounting management) and is maintained under the same security measures described in the "How do we store your data?" section. Since all the data we collect is previously processed by a third-party payment processor such as PayPal, Patreon or Liberapay, by using these or similar services, their use of your information is based on their terms of service and policies, not ours, so we encourage you to review those policies carefully.
+- All additional information you supply on any of the services provided by us is **optional**.

@@ -0,0 +78,4 @@
+<a name="what_we_do"></a>
+## 1.1. What do we do with your data?
+
+- Our processing of your information is limited to storing it for you to use.

@@ -0,0 +79,4 @@
+## 1.1. What do we do with your data?
+
+- Our processing of your information is limited to storing it for you to use.
+- We store logs of your activity for a period no longer than 24hs (unless specified otherwise per service). This data is used to help diagnose software issues, maintain security of the system against intrusion, and monitor the health of the platform.

@@ -0,0 +108,4 @@
+
+- We do not require any additional information that is not crucial for the operation of the service (we do not ask for phone numbers, private personal data, home address).
+
+- We do not read/look nor process your personal data, emails, files, etc., stored on our servers unless needed for troubleshooting purposes, or under suspicion of breaking **Terms Of Services** in which case we ask for prior permission from you or inform you afterwards of all actions taken against the account in the transparency report addressed to account holder.

@@ -0,0 +134,4 @@
+## 4.2 - **Disroot Cloud** (https://cloud.disroot.org)
+  - All files sent to the cloud are encrypted with a key-pair created based on the user password, to add an extra level of security. Note however that the keys are stored on the server, which compromises the level of security to some degree (e.g.: once an attacker knows your password and obtained the encryption key-pair, can decrypt the data). However **no** "Master Key" does exist on our setup, which means the Admins cannot decrypt any files stored on the cloud without knowing user's password prior.
+  - Everything else except for files (calendars, contacts, news, tasks, bookmarks, etc) is stored unencrypted in a database, unless an app provides external encryption (none so far). This is a disadvantaged restriction of the software we are utilizing for this service (Nextcloud).
+  - Server logs, which store information such as, but not limited to, your IP address, your username, an app currently used, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of logfiles are created. Logs are kept mainly to prevent brute-force attacks on accounts as well as provide quick insight when debugging issues.

@@ -0,0 +230,4 @@
+* e. **Right to Data portability** - The right to move, copy or transfer your Data.
+* f. **Right to object** - The right to object to our use of your Data.
+
+\* *This not applies to* **username** *and* **email address** *as they are integral part of your user account and cannot be modified*.

@@ -0,0 +239,4 @@
+
+For the purposes of the **GDPR**, **Disroot.org** is the "data controller". This means that **Disroot** determines the purposes for which and the manner which your data is processed.
+
+If you are not satisfied with the way a compliant you make regarding to how your Data is handled by us, you have the right to send a complaint to the **Information Commissioners’ Office**.