CEagle is run as a hobby project. That is not a disclaimer about how your data is treated. It is the reason the answer to most questions here is "we do not collect that."
Who is responsible#
CEagle is operated by Alessio D'Ambrosio, who is the data controller for everything described here.
Operator- Alessio D'Ambrosio
Email- contact@ceagle.cc
Website- www.alessiodam.dev
CEagle is operated from Belgium, so it is governed by the General Data Protection Regulation and Belgian data protection law.
Who this covers#
This policy covers every part of CEagle: the accounts service, the developer console, the program
registry, the .ce domain service, and the calculator client that talks to them.
What we store#
Your account#
UsernameRequiredPublic. It appears next to anything you publish.
Email addressRequiredUsed to identify the account, to verify it, and to reach you about the account itself. Not public.
PasswordRequiredStored only as a salted hash. It cannot be read back, by us or by anyone else.
Display nameOptional, and public if you set one.
Sessions and sign-in#
Each active sign-in records the IP address and browser user agent it came from, when it was created, and when it was last used.
That is what makes the sessions list on your account page useful: it is how you notice a sign-in you did not make, and how you end it. It is also what lets us rate-limit sign-in attempts rather than letting anyone guess passwords indefinitely.
Applications you sign in to#
If you use your CEagle account to sign in to somebody else's application, we record which application you approved and what you granted it. You can see that list on your account page and withdraw any of them.
The application is told only what you granted: your subject identifier always, and your username, display name or email address only if you approved that.
What you publish#
Projects, build sources, build logs, listings and published programs are stored for as long as the project exists. Published programs, their listings and the account that owns them are public.
Download counts are stored per program as a plain total. We do not record who downloaded what.
Build logs#
A build produces a log, truncated at 24 KiB. It contains whatever your build command printed. Do not print secrets in a build: the log is visible to you, and the program it produces is public.
Technical logs#
Every request is logged with its IP address, the path, the response status, timing and a request id.
Abuse and rate limitingRefusing traffic that is trying to break something requires knowing where it came from.
DebuggingWhen something answers
500, the request id in the response is what makes the failure findable.SecurityNoticing credential stuffing, scraping or an attempt to escape a build sandbox.
Technical logs are kept for 30 days and then discarded. They are never joined to a profile, sold, or used to build a picture of what an individual does.
.ce domains#
A domain registration stores the name, the DNS records you set and the account that owns it. Queries to the nameserver are answered without recording who asked.
Why we are allowed to store it#
Every purpose below has a lawful basis under Article 6 of the GDPR. We do not rely on consent for anything the service needs in order to work, because you cannot meaningfully withdraw consent to your own account existing.
| What | Why | Lawful basis |
|---|---|---|
| Account details and password | to give you the account you asked for | contract |
| Sessions, and the address and browser they came from | to keep you signed in, and to show you where you are signed in | contract |
| Sharing your profile with an application you approved | you chose to grant it | consent, withdrawable at any time |
| Records of which applications you approved | to honour and to let you revoke that grant | contract |
| Projects, listings and published programs | to publish them, which is the service | contract |
| Technical logs, rate limiting, human verification | to keep the platform available and to stop abuse | legitimate interests |
| Download counts | to show authors how their programs are doing | legitimate interests |
| Keeping addresses claimed after archiving | so a program somebody installed cannot be replaced under the same name | legitimate interests |
Where we rely on legitimate interests we have weighed them against your rights, and limited what we keep accordingly: the logs are short-lived, they are not joined to a profile, and they are not used to study individuals.
Cookies#
We use cookies for exactly two things, both strictly necessary.
Session cookieRequiredKeeps you signed in. Removing it signs you out.
CSRF cookieRequiredA random token that proves a form submission came from a page we served, rather than from another site acting as you.
There are no advertising cookies, no analytics cookies and no third-party trackers anywhere on the platform.
Third parties#
We use as few as possible, and none of them are given your data to use for their own purposes.
Cloudflarehuman verification and deliveryThe sign-in and registration pages use Cloudflare Turnstile to tell a person from a bot. It sees the request and its address in order to do that.
GitHubonly if you connect a repositoryConnecting a build source authorises a GitHub App on repositories you choose. It asks for read-only metadata and nothing else. We never receive your GitHub password or token.
Object storage and hostinginfrastructurePublished files and the services themselves run on infrastructure providers who process data on our behalf and are not permitted to use it otherwise.
Where your data is processed#
The services run inside the European Union. Two things reach outside it.
CloudflareUnited StatesHuman verification and request delivery. Transfers rely on Cloudflare's certification under the EU-US Data Privacy Framework and on standard contractual clauses.
Hosting and object storagevariesWhere a provider processes data outside the EU, that transfer is covered by standard contractual clauses or by an adequacy decision.
Every provider acts as a processor under a written agreement, which means they may process your data only to run the service for us and never for their own purposes.
What we do not do#
Not to anyone, in any form, ever. There is no business model here that would want to.
No page-view tracking, no session recording, no fingerprinting, no advertising pixels.
Logs are used to keep the service up and to stop abuse, not to study behaviour.
We have your address so we can contact you about your account. That is all it is for.
How long things are kept#
| Data | Kept |
|---|---|
| Account details | until you deactivate the account |
| Sessions | until they expire or you revoke them, then removed shortly afterwards |
| Application grants | until you withdraw them |
| Security and account audit events | 12 months |
| Technical request logs, including IP addresses | 30 days, then discarded |
| Build logs | for as long as the build record exists |
| Projects and published programs | until the project is archived, and then kept as an archived record |
| Usernames and published addresses | indefinitely, so they cannot be reused |
When you deactivate an account we end its sessions and grants and remove the profile behind it. What stays is the minimum needed to stop the username and any address you published at being claimed by somebody else.
Your choices#
See what is stored
Your account page shows your profile, your active sessions and every application you have approved.
Change it
Display name, email address and password are all editable from the account page.
End sessions and grants
Revoke any session or withdraw any application, at any time, without contacting us.
Deactivate the account
This ends your sessions and grants. Content you published stays published, because other people's calculators may depend on it. Ask us if you need something taken down.
Ask us anything else
Including for a copy of what we hold about you, or for deletion of something this page does not cover.
Complaining#
If you think we have handled your data wrongly, tell us first at contact@ceagle.cc. We would rather fix it than argue about it.
You also have the right to complain to the Belgian supervisory authority, whatever we say:
Address- Drukpersstraat 35, 1000 Brussels, Belgium
Email- contact@apd-gba.be
If you live in another EU country you may complain to your own national authority instead.
Children#
CEagle is used by students, and we have designed it so that using it requires giving us as little as possible: a username, an email address and a password. We do not knowingly collect anything beyond that, and we do not profile anyone.
If you are a parent or guardian and want to know what is stored about an account, contact us.
Security#
Passwords are hashed. Sessions can be revoked individually. Sign-in, registration and account changes are rate-limited and sit behind human verification.
Builds run arbitrary code from public repositories, so they run in a sandbox with no network access and no credentials, on an unprivileged, isolated runtime.
What a build can and cannot reach.
Changes#
If this policy changes in a way that affects what we collect or why, the date at the top changes and we will say so somewhere you will see it. Small clarifications are made without ceremony.
Contact#
Questions about this policy, requests for a copy of what we hold, or anything else covered here go to contact@ceagle.cc. We answer data protection requests within one month, as the GDPR requires.