Privacy Policy
This policy explains which personal data binSource.com processes, why, for how long, and what rights you have. It covers www.binsource.com, forai.binsource.com and the emails the Service sends.
Controller
The controller of your personal data is DELTOREX LLC, 5830 E 2nd St, Ste 7000 #37945, Casper, WY 82609, United States, a limited liability company registered in the State of Wyoming, USA.
We are based in the USA, but we offer the Service to people in the European Union, so our processing is governed by the EU General Data Protection Regulation (GDPR).
Contact for all privacy matters: support@binsource.com. We have not appointed a data protection officer, because the law does not require one for our processing.
What we process and why
Your account
Username, email address, password (stored only as a salted hash), and anything you add to your profile, such as full name, avatar, website, location and description. Also your settings, SSH and GPG keys, access tokens (stored hashed), organization memberships, and the email addresses linked to OpenID sign-in if you use it.
Purpose and legal basis: providing the Service under our Terms of Service (Art. 6(1)(b) GDPR). Your email address is private by default; you decide in your settings whether it is shown.
Content you create
Repositories, commits, issues, pull requests, comments, wikis, releases and packages. Git commits contain the author name and email address that were configured in the Git client that made them; we store and show them as they are. Content in public repositories is public.
Purpose and legal basis: providing the Service (Art. 6(1)(b) GDPR).
Emails from the Service
We send account confirmation, password reset, security notices and the notifications you choose in your settings. We do not send marketing emails without your consent.
Legal basis: providing the Service (Art. 6(1)(b) GDPR). Announcements of material changes to our terms are sent under our legal obligations and legitimate interest.
Technical logs
When you use the Service, our servers record the time, requested address, response status, user agent and network address of the connection. We use these logs to run the Service, find errors and defend against abuse and attacks.
Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR). Logs are deleted automatically after 90 days, unless a specific log entry is needed to investigate a security incident.
Spam protection at registration
The registration form uses Google reCAPTCHA to tell people from bots. When you open the registration page, your browser connects to Google, which receives your IP address, browser data and information about how you interact with the page. Google Ireland Limited processes this data under the Google Privacy Policy; the data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework.
Legal basis: our legitimate interest in preventing automated account abuse (Art. 6(1)(f) GDPR). reCAPTCHA loads only on the registration page.
Website analytics (only with your consent)
If you allow analytics in the cookie banner, the site loads OpenAnalyticsAPI scripts that record the pages you visit, the referring page, the time, the approximate location derived from your IP address (the IP address itself is anonymized), the device type, browser and screen size, and where you click on the page (for heatmaps). A random identifier is stored in your browser so that repeat visits can be counted. We use this data only in aggregated form to learn which pages help people and what to improve. It is not used for advertising or to build a profile of you.
Legal basis: your consent (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications). You can withdraw it at any time with the “Cookie settings” link at the bottom of every page. Analytics data is kept for at most 14 months.
Communication with us
When you write to us, including reports of illegal content and objections to our decisions, we process your message and contact details to handle the request. Legal basis: our legal obligations (Art. 6(1)(c) GDPR) and legitimate interest in answering you (Art. 6(1)(f) GDPR). We keep the correspondence for three years after the matter is closed.
Cookies and browser storage
Necessary items are used without asking, because the Service cannot work without them. Analytics items are used only after you allow them.
| Item | Kind | Purpose | Duration |
|---|---|---|---|
| Session cookie | Necessary | Keeps you signed in during a visit | Until you sign out or the session expires |
| “Remember me” cookie | Necessary | Keeps you signed in across visits, only if you tick “Remember this device” | Up to 31 days |
| CSRF cookie | Necessary | Protects forms against cross-site request forgery | 24 hours |
| Language cookie | Necessary | Remembers the language you chose | Until you clear it |
| Redirect cookie | Necessary | Returns you to the page you wanted after signing in | Session |
bs-theme (local storage) | Necessary | Remembers light or dark mode for visitors who are not signed in | Until you clear it |
bs-consent (local storage) | Necessary | Remembers your analytics choice | Until you clear it |
bs-forai-pending (session storage) | Necessary | Carries the “token for AI agents” setup across one page reload | Browser session |
_oaa_uid (local storage) | Analytics | Random visitor identifier for counting repeat visits | Until you withdraw consent or clear it |
_oaa_sid, _oaa_sid_ts (session storage) | Analytics | Groups page views into one visit | 30 minutes of inactivity |
The reCAPTCHA service on the registration page may set its own cookies; see Google’s policy linked above.
Who receives your data
We do not sell personal data and do not share it for advertising. We run the servers, email delivery and website analytics ourselves on our own hardware; no hosting, email or analytics provider receives your data. Data is disclosed only to:
- Google Ireland Limited: reCAPTCHA on the registration page, as described above.
- Other users and the public: your public profile and public content, and content in private repositories to the people you give access.
- Authorities: only when the law requires us to disclose data, for example on a court order.
Apart from reCAPTCHA, your data is stored and processed on servers in the European Union.
How long we keep data
- Account data and your content: for as long as your account exists. When you delete something, it is removed from the live system immediately and from operational snapshots within 5 days.
- Comments and other contributions to other people’s repositories stay after you delete your account, but they are shown as coming from a “Ghost” user and are no longer linked to you. Git history keeps the author name and email written into each commit, because changing it would rewrite other people’s repositories.
- Technical logs: 90 days.
- Analytics: at most 14 months.
- Correspondence: three years after the matter is closed.
Security
All connections use HTTPS. Passwords and access tokens are stored only as hashes. Access to servers is limited to our administrators. If a personal data breach occurs that is likely to put your rights at risk, we will notify the competent data protection authority and, where the law requires it, you.
Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased (you can delete your account yourself in Settings → Account);
- restrict processing;
- data portability (you can clone all your repositories with Git at any time, and we will provide your account data on request);
- object to processing based on our legitimate interest;
- withdraw your consent to analytics at any time, without affecting processing that took place before.
Send requests to support@binsource.com. We answer within one month. We may ask you to confirm the request from the email address of your account.
You can also file a complaint with the Czech supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or with the authority in the EU country where you live or work.
Children
The Service is not intended for children under 15, and they may not create an account.
Changes
We will update this policy when our processing changes. Material changes will be announced by email and on the Service before they take effect. The effective date at the top shows the current version.