Privacy notice
What Catflap records about you, why, for how long, and what you can do about it.
Who is responsible
This Catflap server, catflap.uni-obuda.hu, is run by whoever set it up, who is the controller of your personal data. Catflap is open-source software; its authors do not run this server and receive no data from it.
Questions about your data: the service team's address is shown on the help page once configured. You can also contact the operator's data protection officer.
What we record and why
Catflap records only what it needs to run the service, keep it secure and learn how it is used. It never records what your AI apps send through your tunnels or what your computer answers: no file contents, commands, tool arguments or results.
| Data | What exactly | Why | Kept |
|---|---|---|---|
| Account | Username, email address, whether you are an admin, when you signed up, last logged in and were last active, and whether you objected to usage statistics. Your password stays with the sign-in service (Keycloak). | To sign you in, give you your tunnels and contact you about your account. Contract (GDPR Art. 6(1)(b)): needed to provide the service you signed up for. | Until you delete your account. |
| Tunnels, API keys and connected apps | Tunnel names, when each was created and last online; API key names and the first characters of each key. Keys and tokens themselves are stored only as hashes. | To run your tunnels and let only you and the AI apps you allowed use them. Contract (GDPR Art. 6(1)(b)): needed to provide the service you signed up for. | Until you delete them or your account. |
| Website login session | One strictly necessary cookie (catflap_session) that keeps you signed in, with your display preferences. | To keep you signed in. Contract (GDPR Art. 6(1)(b)): needed to provide the service you signed up for. | 14 days at most; 3 days without use. |
| Requests through your tunnels | Time, tunnel, the AI app's name and how it signed in, the method and tool, the names of the tool's top-level arguments and their size in bytes, the size of the result, how long it took and whether it worked. Never the argument values, the results or error messages. | To show you your activity, find faults, and learn which tools and AI apps people use. Legitimate interest (GDPR Art. 6(1)(f)): running, securing and improving the service; you can object. | 90 days, then only as anonymous daily totals. |
| App and command-line connections | When a desktop app or command-line agent connected and disconnected, its version, operating system and processor type, and whether it shared the built-in tools, the sandbox or another server. Never the command line or your files. | To find faults, know which versions and systems to support, and see how the service is used. Legitimate interest (GDPR Art. 6(1)(f)): running, securing and improving the service; you can object. | 90 days, then only as anonymous daily totals. |
| Account activity | Days you used the service, logins, logouts, and changes to your keys, tunnels and connected apps. | To keep your account secure, help when something goes wrong, and see how the service is used. Legitimate interest (GDPR Art. 6(1)(f)): running, securing and improving the service; you can object. | 90 days, then only as anonymous daily totals. |
| Admin actions | When an admin disabled or enabled your account and why, and when an admin looked at your activity. | Accountability for what admins do. Legitimate interest (GDPR Art. 6(1)(f)): running, securing and improving the service; you can object. | Until you delete your account. |
| Sign-in events (Keycloak) | Registrations, logins, failed logins, email verifications and password changes, with the time and IP address, kept by the sign-in service. | To protect accounts against attacks; the service keeps only daily counts. Legitimate interest (GDPR Art. 6(1)(f)): running, securing and improving the service; you can object. | 90 days. |
| Website visits | Daily counts of page views per page, referring site, device type, browser and operating system, and of unique visitors. Visitors are counted with a hash of the IP address and browser that changes every day and is never stored; no cookies are used. | To learn which pages help people and where they come from. Legitimate interest (GDPR Art. 6(1)(f)): running, securing and improving the service; you can object. | Kept as anonymous daily totals; they do not identify anyone. |
Usage statistics
Records that name you are deleted after 90 days. Before that, they are added up into daily totals (for example "120 requests to the tool fs_read on 3 March"), which name no one and are kept to see how the service develops.
For requests through your tunnels Catflap keeps the names of a tool's arguments, such as path, but never their values. Names that do not look like ordinary identifiers are replaced by a question mark.
You can object at any time on Your data: nothing new is recorded about you, and the records about you are deleted at once.
Cookies and website statistics
The website sets one cookie, catflap_session, and only when you sign in. It is strictly necessary to keep you signed in, so it needs no consent.
Visits are counted without cookies, and nothing that identifies you is stored in your browser (the page script only remembers the current page's address for the back button, until you close the tab). To count unique visitors, the server combines your IP address and browser name with a random value that changes every day, keeps the result in memory for that day, and stores only the number of visitors. Your IP address is never stored. If your browser sends Global Privacy Control or Do Not Track, your visits are not counted at all.
Who sees it
You and the service's admins on this server. Catflap uses no analytics, advertising or tracking services, and your data is not sold or passed to third parties. It is stored on the service's own servers. When an admin looks at your activity, that is recorded in your account's audit log.
Your rights
- Access and portability: see what is kept and download it as a file on Your data.
- Correction: change your email address on the account page.
- Erasure: delete your account with everything in it on Your data.
- Objection: leave the usage statistics on Your data.
- Restriction and anything else: contact us as above.
You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), Falk Miksa utca 9–11, 1055 Budapest, naih.hu, or to the authority where you live or work.