PRIVACY POLICY
==============

We keep this short and plain — no legalese walls.
If something is unclear, email us and we'll explain.


WHO WE ARE
----------
NaaS (No as a Service) is operated independently. Contact: [email protected].


WHAT WE COLLECT
---------------
Analytics (optional)
  If you allow analytics, we use PostHog to measure page views and feature
  usage. You can decline or change your choice in Analytics preferences in
  the footer. We store your preference in your browser.
  Analytics identifiers are held in memory for the current page lifetime.
  We do not send account names, emails, API keys, or form inputs to PostHog.
  Automatic click collection and session recordings are disabled. Page URLs
  exclude query strings and fragments. Requests also convey technical data,
  including an IP address, to the analytics provider.

Account data (only if you sign in)
  When you sign in via GitHub or Google we receive your email address and
  display name from that provider. We store this to identify your account.

API keys
  If you generate an API key via Settings, we store a hashed version of the
  key. We cannot recover the plaintext after creation.


WHY WE COLLECT IT
-----------------
Analytics     — optional usage measurement based on your consent.
Account data  — performance of the contract (GDPR Art. 6(1)(b)).
API keys      — performance of the contract (GDPR Art. 6(1)(b)).


THIRD PARTIES
-------------
PostHog        optional analytics; the configured collection host is in
               the EU.
GitHub/Google  OAuth providers. Their privacy policies apply to the data
               they share with us.
Cloudflare     infrastructure (Workers, D1 database). Cloudflare offers an
               EU Data Processing Addendum.


DATA RETENTION
--------------
Analytics data  events already sent are retained according to the PostHog
                project retention settings. Withdrawing consent stops future
                collection; it does not delete previously sent events.
Account data    retained until you delete your account via the Settings page.


YOUR RIGHTS
-----------
Under GDPR you have the right to:
  - Access the personal data we hold about you.
  - Correct inaccurate data.
  - Request erasure ("right to be forgotten").
  - Data portability.
  - Object to processing or withdraw consent at any time.
  - Lodge a complaint with your local supervisory authority.

To exercise any of these rights, email [email protected].


CONTACT
-------
Questions? Email [email protected].


Last updated: 2026-09-20