Privacy statement · PrivateHub

01Lead#

The data controller for this instance is PrivateHub, which operates it at https://www.privatehub.iaactiva.com. PrivateHub is self-hosted software: data lives on the operator's infrastructure and is never sent to the makers of PrivateHub.

02Data we process#

Account data (username, email, hashed password, passkeys, second factor and the external provider id if you sign in with Google/Firebase); the date you accepted the terms and the version you were shown; the account category and its term; content you upload (code, documents, versions, comments, chat); and technical data (IP address, browser and device of each session, audit and error logs).

03What gets published about you#

If you publish a repository, anyone can see it without an account, along with your display name, your profile photo if you set one and the badges your account carries. You decide which repositories are opened and can close them again whenever you want; whatever was downloaded or copied while they were open is beyond the operator’s control.

04Purposes#

Providing the service (authenticating you, storing and versioning your content, collaborating), ensuring security (audit, active sessions, alerts), meeting traceability obligations (signatures, timestamps, reports) and sending you the notices you have enabled (email, push, Telegram).

05Third parties#

Data is shared only with the services that the operator or you configure: AI providers (content excerpts), identity providers (Google/Firebase), timestamping authorities, storage mirrors (S3, MongoDB), email, Telegram and push notifications. Without that configuration, no data leaves the instance.

06Retention#

Content is kept for as long as the repository exists or until the configured expiry rules apply. If your account runs out of term, the content stays and the account becomes read-only; the operator may delete accounts that remain inactive or expired, giving notice to the email on record. Audit logs are kept for as long as the operator defines; inactive sessions are deleted after 30 days.

07Security#

Hashed passwords, optional encryption at rest, two-step verification and passkeys, security headers, revocable sessions and encrypted backups. The operator is responsible for serving the instance over HTTPS and safeguarding the keys.

08Your rights#

You can check and change your data in «My account» and close your sessions whenever you want. In «My account → Your data» you have, without asking anyone, the download of everything we keep about you in a ZIP and the deletion of your account. Deleting it removes your profile, your credentials and your private conversations; what you wrote in shared places stays without your name —or is deleted too, if you ask for that— so other people keep their thread, and the audit log is kept with a pseudonym instead of your name, because it is what backs the delivery evidence of approved versions and keeping it answers an obligation of the operator.

09Cookies#

The Platform uses only a technical session cookie and the browser's local storage for preferences (theme, language, dismissed notices). There are no tracking or advertising cookies.

10Changes and contact#

This statement may be updated; the current version is the one published here. To exercise your rights or ask questions, write to jhonatanlaur@gmail.com.