Privacy policy draft

Last updated: 2026-10-08

Draft — requires legal review before publication. The operator must fill in their identity, contact method, applicable jurisdiction and provider/backup handling details. This describes current server behavior; payments and asset uploads are not implemented.

Officelings lets account holders share an office's current agent presence. Sharing is opt-in, and new offices are private until the owner publishes them. Anyone with a public office URL can view, copy or redistribute its presence. Aliases and timing can identify you, so use labels you are comfortable making public.

What the service stores

The database stores an opaque account UUID, numeric GitHub ID, plan field and creation time. The plan currently does not activate a paid tier. Office records contain UUID, owner, public/private status and creation time. Ingest tokens are stored as hashes plus UUID, owner/office binding, creation/revocation time, optional expiry and coarse last-use time. Token secrets are shown once when created. Last use records successful authentication, even if the later payload is rejected; it updates at most every five minutes by default. We do not store GitHub usernames, email addresses, avatars or provider access/refresh tokens.

The database also has asset metadata and report tables, although there are currently no upload or report-creation endpoints. Asset metadata includes ownership, a storage key, type, size, dimensions, content digest and creation time. Report metadata includes office/reporter identifiers, category, status and creation time. Audit records store fixed action names, opaque account/target identifiers and timestamps.

Presence is held only in app memory: alias, platform, state, role, parent reference and server receipt/expiry time. Only the latest snapshot per office is held. Default retention is 90 seconds after receipt; the operator may shorten it. A periodic five-second sweep removes expired snapshots. Restart also clears them. Presence is not saved as history in PostgreSQL or browser storage. The server rejects extra payload fields, including task text, paths and session IDs. Alias checks remove some abusive/contact-like text but cannot guarantee anonymity or detect all abuse.

Request logs contain method, route template, status and elapsed time, without bodies, raw URLs, queries, headers, aliases or tokens. Aggregate metrics have no identity labels. IP addresses (IPv6 grouped by /64) are used transiently in bounded in-memory rate limits and concurrent subscription caps and are not included in application request logs. Session/CSRF cookies support login and account protection; session duration is eight hours without sliding renewal. The server keeps its cookie protection keys on a protected local volume.

Providers and retention

GitHub handles login and supplies the numeric account identity. Cloudflare terminates public TLS and carries traffic through its tunnel; it can inspect presence, cookies, bearer credentials and OAuth traffic. Its data handling/log access forms part of the service's privacy boundary. The operator must review and describe the applicable provider arrangements before publishing this notice. No external analytics or moderation service is used by the app.

Audit retention defaults to 90 days. Cleanup runs at startup and every 15 minutes, in batches of up to 500 rows, at most eight batches within a two-second cycle budget by default; failures or backlogs can delay deletion. Token records are capped at 100 per account including active tokens and retained history. Revoked/expired history is removed after 90 days by default, measured from the earlier revoke or expiry time, during issuance and periodic cleanup; failures/backlog can delay this. Active nonexpiring tokens, accounts and offices remain until account deletion. App logs rotate at 10 MB per file, three files per container; this is a size limit, not a time-based promise. The optional local database backup job retains seven days of dumps after successful new dumps. Failed jobs and operator-retained maintenance archives can retain older data longer. Backups share the existing VM; no new storage service is used.

Your data controls

Authenticated owners can export their records and current presence as JSON, list/revoke tokens, unpublish offices and delete their account. These endpoints require the login cookie and a CSRF token; browser state changes must be same-origin. Export and token lists use pages of up to 100 records per collection; follow the returned next page to retrieve all records. Export includes token metadata and excludes bearer secrets/hashes. Deletion requires a separate account-bound confirmation that expires in five minutes. It closes owned live streams, removes presence, deletes owned volume asset files if present, and hard-deletes account, office, token, asset, authored report and audit records. Failed file removal leaves database keys for retry. Other users' reports retain their reporter identity and lose the reference to a deleted office. Logging in again creates a new account.

Deletion does not immediately erase older dumps, WAL, rotated metadata logs, provider records or copies made by public visitors. A restore can bring back data from its backup; the operator must reapply later deletions before reopening access. No permanent deletion ledger is stored by the app. Before publication, add the operator's contact method and a reviewed process for privacy requests and recovery records; do not present this draft as a final legal policy.