PyneHub Privacy Policy
Last updated: July 18, 2026
This Privacy Policy explains what personal data PyneHub ("PyneHub", "we", "us") collects, why we collect it, how long we keep it, and the rights you have. It is written to be compatible with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"). It is written in plain English.
PyneHub is a maintainer-controlled hub where approved developers publish Python apps for Linux phones. The public can browse and view app source; only approved developers can publish.
1. Who is responsible (Controller)
PyneHub is the data controller for the personal data described here. For privacy questions or to exercise your rights, contact: [email protected].
If you are in the EEA/UK and we are required to have a representative or Data Protection Officer, that contact will be published here once designated (see Follow-up actions for operators).
2. What data we collect
We practice data minimization. We collect only:
a) Developer account data
- Developer email address — used to create and log in to a developer account, to send security/account notifications, and to contact you about your submissions. Developer email is the only personal data we collect directly from you at signup.
- Authentication data derived from the above: a securely hashed password (bcrypt — we never store your plaintext password), and 2FA status.
b) Transactional / operational metadata (logs)
When apps are uploaded, downloaded, or otherwise transacted through the hub, we log operational metadata, which may include:
- timestamps of the event;
- file identifiers and app/version identifiers;
- file hashes (e.g., SHA-256 checksums);
- IP address of the requester;
- device identifiers / user-agent presented by the on-device client;
- the action performed (upload, download, install, admin action) and the acting account (for authenticated actions).
This metadata is used for security, integrity verification, abuse prevention, audit, and to operate the service. Some of this data (e.g., IP address, device identifiers) can constitute personal data under GDPR/UK GDPR.
c) What we do NOT collect
- We do not collect end-user (app installer) account profiles; the on-device client does not require an account to browse or download public apps.
- We do not sell personal data. We do not use the data for advertising.
- We do not knowingly collect data from children.
3. Lawful bases for processing (GDPR / UK GDPR)
| Purpose | Lawful basis |
|---|---|
| Creating and managing developer accounts; authentication | Contract (Art. 6(1)(b)) — necessary to provide the account you requested |
| Security, fraud/abuse prevention, integrity verification, audit logging | Legitimate interests (Art. 6(1)(f)) — to keep the hub and its users safe |
| Sending security/account (transactional) notifications | Contract and/or Legitimate interests |
| Meeting legal, tax, or regulatory obligations; responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
| Any optional identity verification you provide on suspicion of abuse | Legitimate interests, or Consent where required |
We do not rely on consent for core account or security processing; where we ever do rely on consent, you may withdraw it at any time.
4. How long we keep data (Retention)
Retention defaults are configured in legal/pynehub.config.yaml and enforced
by a scheduled retention job:
- Operational/transaction logs: retained 90 days (
logs_days), then deleted or anonymized, unless tied to an active security incident or legal hold. - Logs tied to a security incident: retained 730 days
(
security_incident_logs_days) to support investigation and remediation. - Developer account records after account deletion: retained up to
730 days (
developer_account_retention_after_deletion_days) for legal, audit, and abuse-prevention purposes, then deleted. - Developer email / active account data: retained for the life of the account and then per the deletion window above.
We may retain data longer only where required by law or to establish, exercise, or defend legal claims.
5. Who we share data with (Subprocessors & disclosures)
We share personal data only with service providers ("subprocessors") that help us run PyneHub, under contract and only as needed. Current categories:
| Subprocessor / category | Purpose | Notes |
|---|---|---|
| Cloud application hosting & database provider | Hosting the website, developer panel, and database | Hosts developer accounts and logs |
| Object/file storage provider | Storing uploaded app packages and icons | Stores app artifacts and hashes |
| Transactional email provider | Sending account/security emails to developers | Receives developer email + message content |
A current, itemized subprocessor list (legal names, locations) must be maintained by operators and published/available on request (see Follow-up actions). We also may disclose data to comply with law, enforce our Terms, or protect rights, safety, and security.
6. International data transfers (advisory)
PyneHub may process data in countries other than where you live, including transfers out of the EEA/UK. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA), or an adequacy decision where available.
This section is advisory. Confirm the specific transfer mechanism and subprocessor locations with qualified legal counsel before relying on it.
7. Your rights
If you are in the EEA/UK (GDPR / UK GDPR)
You have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority, or the UK ICO).
If you are in California (CCPA / CPRA)
You have the right to: know/access the categories and specific pieces of personal information we collect; delete personal information; correct inaccurate information; and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. You have the right not to receive discriminatory treatment for exercising your rights.
How to exercise your rights
Email [email protected] from the address associated with your account, or use the account controls in the developer panel. We will verify your identity (for example, by confirming control of the account email) before acting. We aim to respond within the timeframes required by law (generally within 30 days under GDPR/UK GDPR and 45 days under CCPA/CPRA, extendable as permitted). You may use an authorized agent where the law allows.
Note: We may be unable to delete data we are legally required to keep, or that we need to retain to complete a security investigation or defend legal claims.
8. Security
We apply administrative, technical, and organizational measures appropriate to the risk, including:
- passwords stored only as bcrypt hashes; TLS/HTTPS in transit;
- two-factor authentication (2FA) for developer accounts;
- role-based access control (RBAC) for logs and admin functions;
- audit logging of uploads, downloads, and administrative actions;
- supply-chain and malware scanning of uploaded artifacts, and SHA-256
checksums for integrity (see
legal/SECURITY_POLICY.md).
No system is perfectly secure; we cannot guarantee absolute security.
9. Changes to this policy
We may update this Privacy Policy. Material changes will be indicated by updating the "Last updated" date and, where appropriate, by notifying developers by email.
10. Contact
Privacy questions or requests: [email protected] Security issues: [email protected]