Privacy policy

drobek.app is run by me, Tomáš Grasl, a solo developer in the Czech Republic. I am the controller of the personal data described here. Write to info@drobek.app about anything on this page.

Your account

To sign in you give an e-mail address, and I send a one-time code to it. Your account keeps that address, your name if you enter one, the workspaces you belong to and the API keys and agent connections you create. Your session is a cookie that only signs you in; drobek sets no tracking cookie of its own. This is needed to provide the service you asked for (GDPR Art. 6(1)(b)).

Your apps

The apps you build, their versions, files and the records they store are kept on drobek.app's server so it can run them. Secrets you enter are stored encrypted and never shown back. Older versions of an app are removed automatically, and only the newest ones are kept.

The people who use your apps

When your app signs its visitors in or stores what they enter, you decide what it collects, and you are the controller of that data; drobek processes it on your behalf only to run your app. Visits to a published app are counted without cookies and without storing an IP address: a visitor is a hash that cannot be recomputed after the day ends, so nobody can be followed from one day or one app to the next. Only totals, page paths and the host of the referring site are kept.

Security and abuse

To stop code guessing, mail bombing and abuse, the server keeps short-lived counters by IP address and e-mail address, and records sign-ins and changes in an audit log for up to 365 days. Errors in the server are reported to Sentry, which receives the error and the request it happened in, not your apps' data. App logs your agent reads are kept for 30 days and screenshots for 7. This is my legitimate interest in keeping the service safe (Art. 6(1)(f)).

E-mail

drobek sends sign-in codes, account-deletion codes, invitations and notices about your apps. Nothing else: no newsletter, no marketing. Mail leaves through my Hostinger mailbox.

This website

www.drobek.app counts visits with Google Analytics 4, only after you say yes in the line at the bottom of the page (Art. 6(1)(a)). The terms list exactly what is sent. You can withdraw at any time with “Analytics” in the footer. The dashboard at drobek.app and the apps people publish do not use it.

Where the data is

On a server rented from Hostinger in Frankfurt am Main, Germany, inside the EU. Backups of the database stay on the same server for a limited time. I do not sell personal data or share it with anyone else, except where the law requires it.

How long

For as long as you have an account. When you delete it in the dashboard, your account, keys, sessions and apps are removed at once; the audit log keeps the record of what happened without your name until it expires, and backups age out after that.

Your rights

You can ask for a copy of your data, its correction or deletion, a restriction of its processing, or object to it, by writing to info@drobek.app. You can also complain to the Czech data protection authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz).

Changes

I may change this policy; the current version is always on this page.