Privacy Policy

Privacy Policy

Last updated: July 14, 2026

This policy describes the optional telemetry implemented by accshift 1.0.0. The 1.0.0 documentation is ahead of the latest stable 0.9.0 release.

Controller and contact

accshift is an open-source project. The project maintainer is the data controller for the hosted telemetry service. Open a GitHub issue without personal data to ask for an appropriate private contact channel for a privacy request.

Consent

Usage telemetry is disabled until the first-run dialog records a choice. Mode A and Mode B are separate opt-ins and can be changed later in Settings > Privacy. The legal basis for either mode is consent (GDPR Article 6(1)(a)).

The onboarding button increments one aggregate refused, basic, or enhanced counter. That counter contains only the date, app version, choice and total, with no installation or request identifier. Its purpose is to measure whether the consent screen is understood and accepted.

The identifier-free choice aggregate and abuse-prevention controls rely on the project's legitimate interests (GDPR Article 6(1)(f)) in evaluating the consent screen and protecting the endpoint. These limited operations do not enable Mode A or Mode B after a refusal.

Data processed

Both telemetry modes can send:

• event name;
• app version, OS family/version and locale;
• platform id for platform-related events;
• duration or count where the event defines one;
• country code derived at the Cloudflare edge.

They do not send account names or ids, persona names, email addresses, credentials, file paths, URLs, hardware ids, or the contents of local files.

Mode A creates a random local anonymous_id. The Worker stores a purpose-specific HMAC of that value for daily-ping deduplication. Ordinary usage events use a separate HMAC over the UTC date, request IP address and User-Agent, so their identifier rotates daily.

Mode B creates a random UUID v4 install_id. It is attached to Mode B events, daily pings and per-platform account-count snapshots. It is not derived from a device, account or hardware identifier.

The Worker reads the request IP address in memory for rate limiting, country derivation and, in Mode A, the daily HMAC. The raw IP address is not written to D1 or Analytics Engine. A rate-limit alert can contain a masked /24 IPv4 or /48 IPv6 prefix.

Processors

• Cloudflare hosts the Worker, D1 database, Analytics Engine and edge rate limiting.
• Resend sends internal operational emails when a rate limit or daily budget is reached. It receives the endpoint name, time and, for rate-limit alerts, a masked IP prefix. It does not receive telemetry event payloads.

No data is sold or used for advertising. Cloudflare and Resend may process data outside the EEA under the transfer mechanisms described in their own privacy and data-processing terms.

Retention

• Analytics Engine events expire after Cloudflare's fixed 90-day retention.
• D1 Mode B pings and account-count snapshots remain until a valid /forget request reaches the Worker successfully.
• D1 Mode A daily pings and aggregate onboarding counters currently have no automatic expiry. They contain an HMAC or no identifier, not a raw IP.
• Rate-limit counters use Cloudflare's 60-second window.

When Mode B is disabled, accshift stops local Mode B collection and asks the Worker to delete its D1 rows. Before making that request, the app moves the old install_id into a non-portable, machine-local deletion queue. A failed request remains pending across restarts, with retry and export controls in Settings; the id leaves the queue only after the Worker confirms deletion. Re-enabling Mode B creates a new id and does not cancel older pending requests. After the Worker accepts a request, it retains that install_id and the deletion time in a suppression table. Cloudflare Analytics Engine does not support row-level deletion, so matching high-frequency events can remain for up to 90 days before automatic expiry.

Access and portability

While Mode B is enabled, or while an old id is awaiting deletion, Export my data sends every active or pending install_id to the Worker and copies the matching D1 daily_pings and accounts_snapshot rows as JSON. Multiple ids are grouped under installations. The export is partial: Analytics Engine cannot be queried per install by this Worker, so high-frequency events are not included.

Mode A events cannot be retrieved for one person or installation because ordinary event identifiers rotate daily and the service does not keep the raw IP or local anonymous_id.

Your rights

Depending on your jurisdiction, you may have rights of information, access, rectification, erasure, restriction, objection, portability and complaint to a data-protection authority. Mode B access and deletion are available directly in Settings > Privacy. Contact the maintainer for any request the app cannot handle.

Withdrawing consent stops future usage events. It does not retroactively remove the identifier-free onboarding aggregate, and the Analytics Engine limitation above applies to residual Mode B events.

Changes

Material changes to fields, purposes, processors or retention require an updated policy and a review of the consent flow.