-
Notifications
You must be signed in to change notification settings - Fork 0
Privacy Policy
Last updated: August 1, 2026
This policy describes the anonymous usage analytics implemented by accshift
1.0.0. The 1.0.0 documentation is ahead of the latest stable 0.9.0
release.
It replaces the policy that described the previous self-hosted stack. The analytics backend moved from Cloudflare D1 and Analytics Engine to PostHog, which changes the processors, the retention period and how deletion works. The fields collected did not change.
accshift is an open-source project. The project maintainer is the data controller for the hosted analytics service. Open a GitHub issue without personal data to ask for an appropriate private contact channel for a privacy request.
There are two tiers, and they do not share a basis.
Enhanced analytics runs on your explicit consent, GDPR Article 6(1)(a). It is off unless you turn it on during the first-launch screen or later in Settings > Privacy. Withdrawing consent is one click and never degrades the app.
Anonymous counters are on once the first-launch screen has been completed. That screen asks about the enhanced tier, so the counters are not consented to in the sense of Article 6(1)(a), and the project relies instead on its legitimate interests in knowing whether the software is used and what to fix first, GDPR Article 6(1)(f). Your right to object is a switch in Settings > Privacy, effective immediately and permanently. The interest is narrow by construction: the tier creates no profile and its ordinary events carry an identifier that changes every night.
Nothing at all is sent before the first-launch screen is completed.
The identifier-free onboarding-choice counter and the abuse-prevention controls on the endpoint rely on the same legitimate interests.
Both tiers can send:
- event name;
- app version, OS family/version and locale;
- platform id for platform-related events;
- duration or count where the event defines one;
- country code derived at the Cloudflare edge.
They do not send account names or ids, persona names, email addresses, credentials, file paths, URLs, hardware ids, or the contents of local files.
The anonymous tier creates a random local anonymous_id. The server never
receives a stored copy of it: it computes a purpose-bound HMAC used only to
deduplicate the daily active-installation count. Ordinary usage events use a
separate HMAC over the UTC date, request IP address and User-Agent, so their
identifier rotates daily and events cannot be linked across days. No user
profile is created on the analytics provider's side for this tier.
The enhanced tier creates a random UUID v4 install_id. It is attached to
every event of that tier and it is what makes retention analysis and
install-scoped export and deletion possible. It is not derived from a device,
account or hardware identifier.
The Worker reads the request IP address in memory for rate limiting, country
derivation and the anonymous daily HMAC. The raw address is stored nowhere and
is never forwarded: every event sent onward explicitly overrides the IP field
with a placeholder and disables location lookup, so the analytics provider
records no address and infers no location beyond the country code computed at
the edge. A rate-limit alert email can contain a masked /24 IPv4 or /48
IPv6 prefix.
- Cloudflare hosts the Worker and the edge rate limiting. The Worker holds no database, no object storage and no event log; it processes requests in memory and forwards them.
- PostHog Inc. stores and analyses the events, in their EU region, hosted in Germany.
- Resend sends internal operational emails when a rate limit is reached. It receives the endpoint name, the time and, for rate-limit alerts, a masked IP prefix. It never receives event payloads.
No data is sold or used for advertising. These processors may process data outside the EEA under the transfer mechanisms described in their own privacy and data-processing terms.
- Events are deleted after 12 months.
- Aggregated monthly counts are retained beyond that so the project can observe a multi-year trend. They contain no identifier of any kind: every value is a count, or a country, version or platform label totalled over a whole month.
- Rate-limit counters use Cloudflare's 60-second window.
While enhanced analytics is enabled, or while an old id is awaiting deletion,
Export my data in Settings > Privacy sends the install_id to the server
and copies the matching person properties and events to your clipboard as JSON,
up to 10000 events.
Anonymous-tier events cannot be retrieved for one person or installation. Their
ordinary identifiers rotate daily and the service keeps neither the raw IP
address nor the local anonymous_id. That is a property of the tier, not a
limitation of the export.
Disabling enhanced analytics stops local collection for that tier and asks the
server to delete everything tied to the install_id. Before making that
request the app moves the old id into a non-portable, machine-local deletion
queue. A failed request remains pending across restarts, with retry and export
controls in Settings; the id leaves the queue only after the server confirms.
Re-enabling the tier creates a new id and does not cancel older pending
requests.
On the server side the person record and its properties are removed immediately. The associated events are queued for an asynchronous batch job run by the analytics provider during off-peak hours, weekly on their cloud, so completion can take up to a week. That job removes events captured before the request; the app closes its upload queue before calling, so the residual window is at most a batch already in flight, and a second request clears any residue.
Depending on your jurisdiction, you may have rights of information, access, rectification, erasure, restriction, objection, portability and complaint to a data-protection authority. Objection to the anonymous tier, and access and erasure for the enhanced tier, are available directly in Settings > Privacy. Contact the maintainer for any request the app cannot handle.
Withdrawing consent or objecting stops future events. It does not retroactively remove the identifier-free onboarding aggregate, which cannot be tied back to an installation, nor the aggregated monthly counts, which contain no identifier to act on.
Material changes to fields, purposes, processors or retention require an updated policy and a review of the consent flow.