Privacy Policy

Elysium ("we", "us", or "our") operates the API App Store platform at hub.ely.karlharrenga.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service.

By using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.

2.1 Account Information

When you register for an account, we collect:

• Email address - Used for authentication and notifications
• Username - Public display name for your profile
• Password - Stored securely using cryptographic hashing
• GitHub profile data - If you authenticate via GitHub OAuth, we may collect your GitHub username and public profile information

2.2 Emblem and Content Data

When you publish emblems or other content, we store:

• Emblem YAML definitions and versions
• Metadata such as descriptions, tags, and categories
• Publication timestamps and update history

2.3 API Usage Data

We automatically collect:

• API request logs (endpoints accessed, timestamps)
• Authentication events
• Error logs for debugging purposes
• Download and usage statistics for emblems

2.4 Technical Data

When you access the Service, we may collect:

• IP address
• Browser type and version
• Device information
• Referring URL
• Pages visited and interaction patterns

We use collected information for:

• Service Operation - Providing core functionality, authentication, and account management
• Communication - Sending service notifications, security alerts, and responses to your inquiries
• Improvement - Analyzing usage patterns to improve the Service and develop new features
• Security - Detecting and preventing fraud, abuse, and security threats
• Compliance - Meeting legal obligations and responding to lawful requests
• Analytics - Aggregated, anonymized analysis of service usage

4.1 Storage Location

Your data is stored securely using Supabase, which utilizes PostgreSQL databases hosted on cloud infrastructure. Data may be stored in data centers located in multiple geographic regions.

4.2 Security Measures

We implement industry-standard security practices including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest
• Secure password hashing using bcrypt or similar algorithms
• Row-level security on database tables
• API token authentication for programmatic access
• Regular security reviews and updates

4.3 Data Retention

We retain your account information while your account is active. Upon account deletion:

• Account credentials are immediately invalidated
• Published emblems may be retained for service continuity
• API logs are retained for 90 days for security analysis
• Aggregated, anonymized analytics may be retained indefinitely

5.1 Essential Cookies

We use essential cookies to:

• Maintain your authentication session
• Remember your preferences
• Ensure secure access to the Service

5.2 Analytics

We may use analytics services to understand how users interact with the Service. These services may use cookies to collect anonymized usage data.

5.3 Third-Party Cookies

Third-party services integrated with the Service (such as GitHub OAuth) may set their own cookies according to their respective privacy policies.

The Service integrates with the following third parties:

6.1 Supabase

We use Supabase for database storage, authentication, and real-time features. Supabase processes data on our behalf and is bound by data processing agreements. See Supabase Privacy Policy.

6.2 GitHub OAuth

If you choose to authenticate via GitHub, we receive your GitHub username and public profile information. GitHub's use of your data is governed by the GitHub Privacy Statement.

6.3 Third-Party APIs

Emblems published on the Service may reference third-party APIs. Use of these APIs is subject to each provider's privacy policy. We are not responsible for the privacy practices of third-party API providers.

Depending on your location, you may have the following rights:

7.1 Access and Portability

You can access your account information and published content through the Service interface. You may request a copy of your personal data in a machine-readable format.

7.2 Correction

You can update your profile information and correct inaccuracies through your account settings.

7.3 Deletion

You may request deletion of your account and personal data. Contact us via GitHub Issues to initiate deletion. Note that:

• Published emblems may be retained if they have been used by others
• Certain data may be retained for legal compliance or security purposes
• Backups may retain data for up to 30 days after deletion

7.4 Objection and Restriction

You may object to certain processing of your data or request restriction of processing in specific circumstances.

7.5 Withdrawal of Consent

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not sell your personal information. We may share data with:

• Service Providers - Third parties that process data on our behalf (e.g., Supabase)
• Legal Requirements - When required by law or to protect rights and safety
• Business Transfers - In connection with merger, acquisition, or sale of assets
• With Your Consent - In other situations with your permission

Your published emblem content is shared publicly according to the license you specify when publishing.

The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

Your data may be transferred to and processed in countries other than your country of residence. We take appropriate measures to ensure adequate protection of your data in compliance with applicable data protection laws.

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Service. Continued use of the Service after changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

For privacy-related questions or to exercise your rights, please contact us through our GitHub Issues.