Privacy Policy

What we collect

When you register a project via /setup, we store:

• Your Crowdin Project ID, in plaintext.
• Your Crowdin Personal Access Token, encrypted at rest.
• A randomly generated public_id, used in your embed URLs.
• A timestamp of when the project was registered.

We do not collect names, email addresses, or any account information — there is no account.

What we log

Request logs record method, path, status code, and duration only. They never record request or response bodies. The /setup endpoint — the only code path where your plaintext token ever transits our server — is explicitly excluded from any logging that could capture it.

Who can see your data

No third-party subprocessors are involved in storing or processing your token — no cloud KMS, no managed database, no external cache provider. The entire data path is the operator's own EU-based virtual machine, plus Crowdin's own API, which you have already chosen to trust by using Crowdin.

The encryption key used to protect your token exists only in the server's runtime environment. It is never written to the database, included in backups, or logged.

How long we keep it

Registered project data is kept until you use your revoke link (see the FAQ) to delete it, or until we remove it at our discretion (e.g. suspected abuse or a long-dead project). Cached SVG output is retained for at most 12 hours plus a short grace period, then either refreshed or swept by an hourly cleanup job.

Your rights

Because this service is self-hosted on an EU-based VM, EU/EEA users have rights under the GDPR, including access to and deletion of the data described above. What we hold about your project is exactly what's listed in "What we collect" above — nothing more. Deletion is self-service: use the revoke link from setup (see the FAQ) to remove your project's row.

Third parties

The only external party in the data path is Crowdin's own API, used to fetch translation progress and top-contributor data for the one project you registered, using the token you provided. See Crowdin's own privacy policy for how they handle data on their end.

Changes to this policy

Material changes will be reflected in the "Last updated" date above.

Contact

Privacy questions: open an issue on the GitHub repository. Data requests are handled through the self-service revoke link described above.