Spritz Depot

Privacy notice

Spritz Depot collects the bare minimum to let you sign in and remember the apps you added to your library. This page explains what we keep, why, and how to exercise your rights.

Data we keep

  • Your email and a hashed password (bcrypt, never in clear). Used for signing in.
  • The list of apps you add to your library (app id, channel, architecture, state). Used to sync installations.
  • Visit statistics: your IP address, the country we derive from it, the site you arrived from (referrer), and the apps you ask to install. The country is resolved against a local database: your address is never sent to any third party. If you are signed in, these events stay linked to your account; requests from the Haiku daemon, which does not log in, are linked to nobody.
  • Coarse, aggregate platform data: your browser family (from the User-Agent) and, when the native Haiku client reports it, your Haiku version and CPU/RAM range. None of it identifies a person (they are values thousands of machines share, bucketed into a few ranges) and it is used only to understand what systems the catalog runs on.

We do not use tracking cookies, we do not profile for advertising, and we do not sell or share data with third parties.

Legal basis and retention

We process this data to perform the service you request (art. 6.1.b GDPR). We keep it as long as your account is active: when you delete it, we erase email, password and library.

Visit statistics are not needed to deliver the service: we process them under our legitimate interest in understanding how Spritz Depot is used and protecting it from abuse (art. 6.1.f GDPR). You may object to this processing by writing to us.

IP addresses are erased after 90 days: only aggregate data survives (country, app, date), which does not identify you. When you delete your account we erase email, password and library, and your download events are anonymised (the address goes, and so does the link to your account).

Your rights

  • Access and portability: download all your data in JSON with a call to /auth/me (authenticated).
  • Erasure: permanently delete your account and all data from the "My data" page, or with /auth/delete-account.

My data

The data controller is Andrea Bernardi. To exercise your rights or for any question about data processing, write to andrea@studiobernardi.eu.