Fadebox Privacy Policy

This Privacy Policy explains what personal data MoresApp s.r.o. processes in connection with the Fadebox website and the Fadebox software, why, and what you can do about it.

1. Who we are

The controller of the personal data described here is MoresApp s.r.o., a limited liability company incorporated under the laws of the Czech Republic, with its registered seat at Wassermannova 921/6, Hlubočepy, 152 00 Praha 5, Czech Republic, company identification number (IČO) 09594965, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 338394.

You can reach us about anything in this policy at hello@fadebox.io.

We have not appointed a Data Protection Officer; we are not required to.

2. What this policy covers

This policy covers the website at fadebox.io, including the documentation published under /docs/, and your correspondence with us.

It does not cover the data inside your own Fadebox installation. Fadebox is software you install and run on your own infrastructure. The environments you deploy with it, the credentials you configure in it, its audit log and its user accounts stay on your servers. We do not operate that installation, we have no access to it, and we receive nothing from it. For that data you are the controller and we are not a processor — section 4 explains why this is a technical fact rather than a promise.

3. The website

The website is a set of static files. It sets no cookies, embeds no third-party scripts, fonts, videos or social widgets, and contains no forms. Fonts are served from the site’s own origin. Loading a page on fadebox.io causes your browser to contact two servers: the one hosting the site, and our own analytics server at umami.fadebox.io.

Analytics. We count page views with Umami, an open-source analytics application that we run ourselves, on a server rented from a hosting provider that stores the data on our behalf as our processor. No analytics company is involved and the data is not shared with anyone else. When a page loads, a small script sends that server the address of the page, the page that linked to it, the page title, your browser’s language and screen size, and — as part of any web request — your IP address and user-agent string. From these the server derives your browser, operating system, device type and approximate location (country, region and city).

It does not store your IP address or your full user-agent string. To tell one visit from the next, it combines them with a secret value that is replaced every month and keeps only a one-way hash. The same browser is therefore counted as one visitor within a month, but cannot be followed from one month to the next or across other websites. The script sets no cookies and writes nothing to your browser’s storage. What we see is aggregate: how many people read which pages and where they came from. Nothing is linked to a name, an email address or a purchase.

We use this to understand which pages people read and which do not work, on the basis of our legitimate interest (Article 6(1)(f) GDPR) in maintaining and improving the site. Blocking umami.fadebox.io in your browser or with a content blocker stops it entirely. The rest of the site works the same.

That host is GitHub, Inc., which serves the site through GitHub Pages and, like any web server, records requests — including your IP address, the time of the request, the page requested and your browser’s user-agent string — in its server logs. We do not receive, query or analyse those logs. GitHub processes them under its own terms to deliver and protect the service.

The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in making the site available and keeping it secure.

Pages on the site link to external destinations, including the store where licences are purchased. Following such a link takes you to a service with its own privacy policy, which governs what happens there.

4. The Fadebox software

The Fadebox software performs no licence-related network communication, collects no telemetry and transmits nothing to us. There is no activation server and no phone-home, on any tier, which is why a fully air-gapped installation licenses exactly like a connected one. Licence keys are verified locally against a public key built into the binary.

The purchase and upgrade links on the software’s License page do not change this. Your browser opens them, only when you click one, and they carry your installation ID alone; the software itself never contacts the store. The installation ID identifies an installation, not a person.

We therefore hold no data about how you use the software, how many environments you run, or what you deploy — not because we have chosen not to look, but because none of it is ever sent.

5. When you contact us

We have no contact form. Writing to us means sending an email, and an email necessarily carries your address, your name if your mail client sends one, and whatever you put in it.

We use that to answer you, and to keep a record of the enquiry and how it was resolved. Where the enquiry concerns a possible purchase, the basis is taking steps at your request prior to entering a contract (Article 6(1)(b) GDPR); otherwise it is our legitimate interest (Article 6(1)(f) GDPR) in responding to people who write to us. Where your message becomes part of a contract with us, or of a document we have to keep, the basis is our legal obligation (Article 6(1)(c) GDPR).

Please do not send us personal data we have not asked for and do not need, and in particular do not send us special-category data or the contents of your production systems. A vulnerability report needs the Fadebox version and reproduction steps, not a database dump.

6. Who else sees it

We do not sell personal data, and we do not share it for anyone else’s marketing.

Two categories of recipient are unavoidable. The first is our hosting providers: GitHub, Inc., which serves the site, and the provider of the server that runs our analytics, both described in section 3. The second is the provider that operates our email service, which necessarily stores and transmits the messages you send us, acting as our processor under a data processing agreement.

Where a purchase takes place, the operator of the store processes your payment and billing data under its own privacy policy and as its own controller; we receive from it only what we need to issue a licence and to meet our accounting and tax obligations.

We disclose personal data to public authorities only where law requires it.

7. Transfers outside the EU

GitHub, Inc. is established in the United States. Where personal data is transferred outside the European Economic Area, that transfer takes place under a transfer mechanism recognised by Chapter V of the GDPR — an adequacy decision where one applies to the recipient, and otherwise the European Commission’s Standard Contractual Clauses together with the supplementary measures the transfer requires.

8. How long we keep it

Correspondence is kept for as long as the matter is live and for a reasonable period afterwards, so that we can pick up a thread you return to. Documents we are required to retain — invoices and accounting records in particular — are kept for the period Czech law prescribes. Server logs are retained by our host under its own retention schedule, not ours. Analytics records hold no direct identifiers and are kept for as long as they are useful for comparing the site’s traffic over time.

9. Your rights

Under the GDPR you have the right to ask us for access to the personal data we hold about you, to have it corrected or erased, to have its processing restricted, to receive it in a portable form, and to object to processing we carry out on the basis of legitimate interest. Where we rely on consent, you may withdraw it at any time, without affecting processing already carried out.

Write to hello@fadebox.io to exercise any of these. We will respond within one month. We may need to ask you for something that establishes the request is yours, particularly where acting on it would disclose data to the wrong person.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.

10. Changes

If this policy changes, the new version is published here with a new version number and effective date, and the previous version stops applying from that date. Changes that materially affect how we handle data we have already collected will be notified to the people affected where we hold a way to reach them.