Privacy Policy

1. Purpose of Gadeiros

Gadeiros is a web application for creating, organizing and managing diagrams, notes, tags, settings and related knowledge in a personal user workspace.

2. Information collected

Gadeiros stores your name, email address, verification status, internal user identifier and account timestamps. Passwords are stored as derived hashes by the authentication system, never as plain text. When you sign in with Google, Gadeiros receives the basic account information needed for authentication, which may include your Google account identifier, name, email address and profile image. The associated provider account and OAuth tokens may also be stored to support authentication; Google sign-in is optional.

Gadeiros also stores the content and preferences you create in the application, including diagrams, notes, tags, imported diagram content and application settings. Sessions store a token, expiry and timestamps, and may include the IP address and user-agent supplied with the request. Browser preferences are stored locally, with workspace settings separated by user identifier; authentication uses cookies.

3. How information is used

Account information is used to authenticate you, associate your account with your Gadeiros workspace and enforce access controls.

Application content is processed only to provide Gadeiros features and maintain your workspace.

4. User isolation and access

Each authorized user has a separate workspace. Application data is associated with the authenticated user and access controls are designed to prevent one user from accessing another user's private application data.

You can create an account using email and password with email verification, or Google when enabled.

5. Data storage and security

Gadeiros is self-hosted on a privately administered VPS. Application and account data are stored in a PostgreSQL database managed by the application operator.

Reasonable technical measures are used to restrict access to the application and its data, including authenticated sessions and database-level access controls.

6. Sharing of information

Personal data is not sold and is not shared with third parties for advertising or marketing purposes.

Better Auth manages authentication. A configured SMTP provider delivers verification and password reset emails. Google is an optional sign-in provider. Information processed by Google as part of Google Sign-In is also subject to Google's own privacy terms.

7. Technical logs and optional AI assistance

The application records operational errors with the affected API route and error details; development logs can also include stack traces. Hosting and proxy logs depend on the operator's configuration. SMTP logging is disabled in the application. If you use AI assistance, your instructions and the diagram content needed for that request are sent to the configured AI provider. This feature is optional.

Account separation restricts access between users; it is not end-to-end encryption. The service operator administers the server and database.

8. Data retention and deletion

Account information and application content are retained while they are needed to provide the service or until deletion is requested, subject to technical backup and operational requirements.

You may request deletion of your Gadeiros account data and associated application content by contacting the application operator.

9. Contact

For questions about privacy, access to your data or a deletion request, contact:

vincent@hermoso.be

10. Changes to this policy

This policy may be updated when Gadeiros features, authentication, hosting or data handling practices change. The current version is published on this page.