Privacy Policy

Version 2026-10-27

This policy explains what personal data Django Fullstack Starter processes, why, for how long, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is [Company name], [Registered address], registration number [Company registration number]. For anything about your personal data, contact [privacy@example.com].

2. What we process and why

Your account

Your email address, a hash of your password (we never store the password itself), your first and last name if you add them, and the dates you registered, verified your email and last signed in. We need this to provide the service you signed up for (Art. 6(1)(b) GDPR, performance of a contract).

Security of the service

When you sign in, register or reset your password, we record the time, your IP address and your browser type, and for failed sign-ins a pseudonymous code instead of the email address. We use this to detect and stop attacks such as password guessing and to protect your account (Art. 6(1)(f) GDPR, our legitimate interest in keeping the service and your account secure). If you set up two-factor authentication, we store the method you chose; the secret for authenticator apps is stored encrypted.

Acceptance of these documents

When you register we record which versions of the Terms of Service and this policy you accepted, when, and a pseudonymous code derived from your IP address, as proof of your agreement (Art. 6(1)(b) and (c) GDPR).

Emails we send you

We send only emails needed for your account: confirming your address, resetting your password, and security notices such as "your password was changed". We do not send marketing emails.

3. Cookies

We use one cookie, __Host-sessionid, which keeps you signed in and protects forms against forgery. It is strictly necessary for the service, so it does not need your consent. It ends when you close the browser and expires on our side after at most 2 hours of inactivity or 7 days. We use no analytics, advertising or tracking cookies.

If you choose a language in the language menu without being signed in, we store that choice in a cookie, __Host-language, for one year. It is set only when you choose a language and contains nothing but the language code. When you are signed in, the choice is saved on your account instead.

If you choose a colour theme or collapse the menu, your browser remembers that choice in its local storage on your device. It is never sent to us.

4. Service providers

We use the following providers, who process data only on our instructions under a data processing agreement:

• Contabo GmbH (Germany (EU)): Hosting of the application and its database.
• Resend, Inc. ([United States or EU region: check the region chosen in the Resend account]): Sending transactional emails (verification, password reset, security notices).
• Backblaze, Inc. ([EU Central region (Netherlands): check the bucket region]): Encrypted backups.
• Cloudflare, Inc. ([Global network: check Cloudflare's data processing terms]): Bot protection on registration and password reset (Turnstile).

Where a provider processes data outside the European Economic Area, the transfer is protected by [the EU-US Data Privacy Framework / Standard Contractual Clauses].

5. How long we keep data

• Account data: as long as your account exists. When you delete your account, it is deleted after 14 days (you can cancel until then); records we must keep are anonymized.
• Accounts whose email address was never confirmed: 7 days.
• Security records (sign-ins, failed attempts): full IP addresses for 30 days, then shortened to the network; the records themselves for 365 days.
• Records of administrative changes to accounts: 730 days.
• Email delivery records (address and status, never the content): 30 days.
• Acceptance records (which version of the Terms and this policy you accepted): as long as your account exists, then kept without your name or email address for [the limitation period].
• Backups: up to [6 months], after which they are overwritten.

6. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to processing based on our legitimate interests, and to receive your data in a portable format. You can download your data and delete your account yourself, under Security in your account. For anything else, write to [privacy@example.com]. You can also complain to a data protection authority, in particular [Your national data protection authority, with website].

7. Security

We protect your data with encrypted connections, hashed passwords, optional two-factor authentication, limited access for our staff, encrypted backups stored outside our main server, and regular security updates.

8. Changes

When this policy changes we publish the new version here with a new version date, and inform you when you next sign in if the change affects you.