Privacy policy
What we store, why, for how long, and who else touches it — under the GDPR and the Austrian DSG. Last updated 1 October 2026.
In short
- Statistics only if you say yes. Nothing measures you until you accept, and rejecting is one click in the same banner.
- No advertising cookies, no remarketing pixel, no cross-site identifier. We do not profile visitors.
- The contact form does not send anything to us — it opens your own mail program.
- There is no password to steal: we do not store one.
- Evidence from a test is encrypted per organisation and deleted after 30 days.
- Everything we store lives in the EU. Sign-in and mail delivery are the exceptions, and both are named below.
Controller
- Responsible
- Polaris1
Graz, Austria - support@polaris1.dev
- Privacy enquiries
- support@polaris1.dev
- Data protection officer
- Not appointed. Art 37 GDPR does not require one at our size and for our activity.
Visiting this website
Server logs
The site is delivered by Cloudflare Pages. Cloudflare records the IP address, the time, the file requested, the referring page and the browser identification. This is technically unavoidable — without an IP address no page can be delivered — and it is what lets an attack be recognised as one.
- Purpose: delivering the site, keeping it available, defending against attacks.
- Legal basis: Art 6(1)(f) GDPR — our legitimate interest in a site that works and is not taken down.
- Retention: Cloudflare keeps request logs for a short period under its own policy; we do not build our own log archive from them and do not link them to accounts.
Fonts
All typefaces are delivered from our own server. Until 23 September 2026 the wordmark typeface came from Google Fonts, which meant your browser requested a file from Google and Google received your IP address before you could object. That request is gone: the font file now sits next to the page. No font causes a request to a third party.
Statistics, if you allow them
We use Google Analytics 4 to see which pages are read and which are not. It is switched off until you accept it in the cookie banner, and nothing about you is measured before that. Rejecting is one click in the same banner, costs you nothing, and the site behaves identically either way.
- Purpose: understanding which pages people read, so we can write better ones.
- Legal basis: Art 6(1)(a) GDPR and § 165(3) TKG 2021 — your consent, and nothing else. You may withdraw it at any time through the Cookie settings link in the footer of every page; it takes effect immediately and we delete the cookies.
- Recipient: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4. Data may be processed in the USA — see Transfers outside the EU below.
- What we switched off: advertising signals and ad personalisation
(
allow_google_signals,allow_ad_personalization_signals). We do not run Google Ads, and no advertising profile is built from your visit. - Retention: Google deletes the event data after 14 months.
No tag manager, no advertising or remarketing pixel, no cross-site identifier, no profiling. If you reject statistics, no request to Google happens at all — the script is not loaded, not merely switched idle.
The site stores exactly one value in your browser: p1-theme, in
localStorage, remembering whether you chose the light or dark appearance. It
never leaves your device and is not a cookie.
The contact form
The form on the contact page submits to no server. When you press send, your entries are assembled into a draft that opens in your own mail program — you decide whether to send it. Until you do, we receive nothing.
Once you send it, the mail reaches us like any other: your address, your name and what you wrote. Legal basis: Art 6(1)(b) GDPR where you are asking about an engagement, otherwise Art 6(1)(f). We keep the correspondence for as long as the matter is live and delete it afterwards, unless commercial retention rules (§ 132 BAO, § 212 UGB) require otherwise.
Your account
What we store
Your email address, your name if you give one, the organisation you belong to and your role in it. No password — there is no password column in our database, because we removed it. You sign in with a six-digit code sent by mail, or with Google or GitHub.
If you switch on a second factor, we store the TOTP secret encrypted, never in plain text.
Sessions
A signed-in session is stored server-side with a hash of the session token, the IP address it was created from, the browser identification, and the times it was created, last seen and expires. It lets you stay signed in and lets you recognise a session that is not yours. Sessions expire after 30 days and can be revoked at any time from the dashboard.
Failed sign-in attempts
Failed attempts are counted per source and per account, in quarter-hour windows, so that
someone cannot work through a list of addresses. The counter holds a key
(ip:… or user:…), the window and the number — no
entered values. It is deleted after one day. Legal basis: Art 6(1)(f) GDPR.
The audit log
Every action that touches findings, access or billing is written to an audit log: who, what, when, from which IP address, with which browser and which request identifier. This is not optional. It is the record that tells you afterwards who opened a piece of evidence — including us, if you granted us access. Legal basis: Art 6(1)(b) and (f) GDPR.
Running a test
A test is directed at systems you own and have proven you own, with a DNS record. What it produces is technical data about those systems: hostnames, reachable endpoints, the files your application ships, and the findings themselves.
That data can contain personal data if your application exposes it. We take deliberate care that as little as possible of it lands with us:
- Secrets are redacted before storage. We keep what proves a finding, not the records it was found in.
- Evidence is encrypted per organisation with a key bound to your organisation's identifier. The same ciphertext under a different account decrypts to nothing.
- Evidence is deleted after 30 days, enforced by a job that runs and can be checked, not by a storage provider's retention setting.
- Reading unredacted evidence requires a link that expires within minutes, and every access is written to the audit log.
Where a test touches personal data of your users, you are the controller and we are the processor. A data processing agreement under Art 28 GDPR is available — ask at support@polaris1.dev and we send it signed.
Payments
Payments are not active yet. When they are, they will run through Stripe, which receives the data needed to take the payment. We never see or store card details. This section will be updated with the details before the first invoice goes out.
Cookies
Two groups, and the difference matters. The first is strictly necessary — it makes signing in work and protects the forms. It needs no consent and cannot be switched off, because without it the product does not function. Legal basis: § 165(3) TKG 2021 and Art 6(1)(b)/(f) GDPR.
Strictly necessary
- polaris1_session
- Keeps you signed in. HttpOnly, so JavaScript never sees it. Expires after 30 days.
- polaris1_csrf
- Protects every state-changing request against being triggered from another site.
- polaris1_code
- Binds a sign-in code to the browser that asked for it. Short-lived.
- polaris1_oauth
- Carries the state value during a Google or GitHub sign-in. Deleted on return.
- polaris1_invite
- Remembers an invitation across the sign-in. Short-lived.
- polaris1_totp_enrol
- Holds a second factor being set up, until it is confirmed.
- polaris1_org_name
- Shows the right organisation name while signing in.
- polaris1_consent
- Remembers the choice you make in the cookie banner, so we stop asking. 6 months.
Statistics — only after you accept
These are set by Google Analytics and only once you have accepted them. Reject, and they are never written; withdraw later through Cookie settings in the footer, and they are deleted. Legal basis: Art 6(1)(a) GDPR, § 165(3) TKG 2021 — your consent.
- _ga
- Distinguishes one visitor from another. 2 years.
- _ga_<id>
- Keeps the session state for the property. 2 years.
Processors
Everyone below processes data on our instructions under Art 28 GDPR.
- Fly.io
- Runs the application. Frankfurt, Germany.
- Supabase
- The database. EU region.
- Cloudflare
- Delivers the website, stores evidence (R2, EU jurisdiction), answers DNS.
- Amazon Web Services
- Key management for evidence encryption (KMS, eu-central-1).
- Resend
- Delivers our email — sign-in codes, notifications, invoices.
- Google & GitHub
- Only if you choose to sign in with them, and only then.
- Google Ireland Ltd
- Google Analytics — website statistics. Only if you accept them.
- Stripe
- Payments.
Transfers outside the EU
Everything we store — database, evidence, keys, the machines that run the tests — stays in the EU. Three things can leave it, and we would rather name them than claim otherwise:
- Sign-in with Google or GitHub, if you choose it. Both are US providers.
- Mail delivery through Resend.
- Google Analytics, but only if you accepted statistics. Reject, and no request to Google happens.
These transfers rest on the EU Standard Contractual Clauses and, for the US providers, on the EU–US Data Privacy Framework. You can avoid the first by signing in with a code by mail instead, and the third by rejecting statistics in the cookie banner — or by withdrawing later, which stops it from that moment on.
DNS ownership checks query public resolvers. Those requests contain the domain being verified — a name you chose to make public — and no personal data.
How long we keep things
- Evidence from a test
- 30 days, then deleted by a job that runs on a schedule.
- Sessions
- 30 days, or until you revoke them.
- Failed sign-in attempts
- 1 day.
- Sign-in codes and links
- Minutes. Single use.
- Domain ownership tokens
- 14 days.
- Invitations
- 7 days.
- Evidence access grants
- 7 days by default, revocable at any time.
- Repository access
- 90 days by default, revocable at any time.
- Findings and reports
- As long as your account exists — they are your record. Deleted with the account.
- Audit log
- As long as your account exists. It is the proof of who did what.
- Invoices
- 7 years, because § 132 BAO requires it.
Legal bases
- Art 6(1)(a) — consent: website statistics. Only this one rests on consent, and only it can be withdrawn with a click.
- Art 6(1)(b) — performing the contract: your account, running tests, reports, invoices.
- Art 6(1)(c) — legal obligation: keeping invoices.
- Art 6(1)(f) — legitimate interest: delivering the site, defending against attacks, the audit log, throttling failed sign-ins.
Where we rely on legitimate interest, you may object under Art 21 GDPR. Write to support@polaris1.dev and we will explain the balance we struck or stop.
Your rights
Under Art 15 to 21 GDPR you may ask for access to your data, correction, deletion, restriction of processing, portability in a machine-readable form, and you may object to processing based on legitimate interest.
Withdrawing consent needs no email: the Cookie settings link in the footer of every page reopens the choice. Withdrawal takes effect immediately and does not affect the lawfulness of what happened before it.
Write to support@polaris1.dev. We answer within one month. There is no fee, and no form to fill in.
You can also complain to the supervisory authority:
- Authority
- Österreichische Datenschutzbehörde
- Address
- Barichgasse 40–42, 1030 Vienna, Austria
- Web
- dsb.gv.at
Changes
When this policy changes, the date at the top changes with it. If a change affects how we handle data you have already given us, we tell you by email rather than expecting you to notice.