Privacy Policy
This is placeholder content shipped with the template — it is not a real privacy policy. Replace this page with one that accurately describes what your deployment actually collects.
What this template collects by default
Account details you provide (name, email, password or OAuth identity), and — for every sign-in — device, browser, approximate location, and referrer, used for the audit log under Admin → Activity Logs. See lib/request-info.ts.
Cookies and similar technologies
Always on (necessary): sign-in session cookies, a 5-minute cookie remembering which page a sign-in started from, your cookie choice itself, sidebar and theme preferences, and short-lived browser storage for sign-in retries and "what's new" notices.
Only if you accept optional cookies: a device fingerprint (FingerprintJS) used to alert you about sign-ins from new devices, to limit repeated failed sign-ins, and to spot one device creating many accounts; and Google One Tap sign-in, which loads a Google script that may use Google's own cookies. If you decline, failed sign-ins are limited by IP address instead.
You can change your choice at any time via "Cookie settings" in the footer.
Where it's stored
In your own Postgres database, via the schema in server/db/schema.ts — nothing here is sent to a third party by default.
Your obligations
If you collect personal data from real users, you're responsible for disclosing that accurately here and complying with the privacy laws that apply to you.