Template notice. This document is a starting template written for OpenSourceLabs. It is not legal advice and must be reviewed by a qualified lawyer and adapted to your company details and jurisdiction before it is relied on.
1. Who we are
OpenSourceLabs ("OpenSourceLabs", "we", "us") operates a directory of public open-source repositories hosted on GitHub, organized by category, with search, repository pages, and user accounts (the "Service").
For the purposes of data protection law, OpenSourceLabs is the controller of the personal data described in this policy. You can contact us at hello@opensourcelabs.dev. [Insert legal entity name, registered address, and, if required, the details of your data protection officer or EU/UK representative.]
2. Information we collect
We collect only the information we need to run the Service:
- Account information: your email address, display name, and a salted hash of your password when you create an account. We never store your password in plain text.
- Session information: a refresh token stored in an HttpOnly cookie and a short-lived access token kept in your browser’s memory, used to keep you signed in.
- Usage and technical information: IP address, browser type, pages requested, search queries, and timestamps recorded in server logs for security, debugging, and aggregate statistics.
- Preferences: your light or dark theme choice, stored locally in your browser.
- Communications: the content of emails you send us, such as repository suggestions or support requests.
We do not ask for, receive, or store your GitHub credentials or tokens. Repository information shown in the catalog comes from public GitHub data collected by our servers.
3. How we use your information
- To create and secure your account, authenticate you, and keep you signed in.
- To provide the catalog, search, and dashboard features you request.
- To send essential service messages, such as password reset instructions.
- To protect the Service against abuse, fraud, and security threats, including rate limiting and investigating suspicious activity.
- To understand aggregate usage and improve the catalog and the product.
- To comply with legal obligations and enforce our Terms and Conditions.
4. Legal bases for processing
Where the EU or UK General Data Protection Regulation applies, we rely on: performance of a contract (to provide your account and the Service); legitimate interests (to secure and improve the Service, balanced against your rights); legal obligation (where the law requires us to keep or disclose data); and consent (where we ask for it, which you can withdraw at any time).
6. Third-party content and links
Repository pages display public content from GitHub, such as README files and images, and link to external sites including GitHub and StackBlitz. Images referenced in a README may be loaded from the repository’s host. When you follow an external link, the privacy policy of that site applies.
8. Data retention
- Account data is kept while your account is active and deleted within 30 days [confirm] after you ask us to close it, unless we must keep it longer by law.
- Refresh tokens expire after 14 days and are deleted when you sign out.
- Server logs are kept for a limited period (for example, 90 days) for security purposes. [Confirm your actual retention periods.]
9. How we protect your data
We use HTTPS, salted password hashing, HttpOnly and SameSite cookies, anti-forgery tokens, and sanitization of third-party HTML. Access tokens are kept in memory instead of web storage. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of a breach where the law requires.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right to know and to delete, and we do not sell or share personal information for cross-context behavioral advertising.
To exercise your rights, email hello@opensourcelabs.dev. You also have the right to lodge a complaint with your local data protection authority.
11. International transfers
We may process data in countries other than your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses. [Describe your hosting regions.]
12. Children
The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, notify signed-in users by email or in the app.
14. Contact us
Questions about this policy or your data: hello@opensourcelabs.dev.