# 2026-09-30: Updated Privacy Policy and sub-processor list

**URL:** <https://forum.codefloe.com/t/2026-09-30-updated-privacy-policy-and-sub-processor-list/204>\
**Category:** Announcements\
**Tags:** changelog\
**Created:** [September 30, 2026, 6:12pm UTC](https://forum.codefloe.com/t/2026-09-30-updated-privacy-policy-and-sub-processor-list/204 "2026-09-30T18:12:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![codefloe](https://forum.codefloe.com/user_avatar/forum.codefloe.com/codefloe/32/42_2.png) [@codefloe](https://forum.codefloe.com/u/codefloe)\
**Post date:** [September 30, 2026, 6:12pm UTC](https://forum.codefloe.com/t/2026-09-30-updated-privacy-policy-and-sub-processor-list/204/1 "2026-09-30T18:12:54Z")

</div>

# Updated Privacy Policy and sub-processor list

We have rewritten the CodeFloe Privacy Policy and published a list of the providers that process data on our behalf.  
Both take effect today, 2026-09-30.  
You do not need to do anything.

- Privacy Policy: [https://codefloe.com/codefloe/legal/src/branch/main/PrivacyPolicy.md](https://codefloe.com/codefloe/legal/src/branch/main/PrivacyPolicy.md)
- Sub-processors: [https://codefloe.com/codefloe/legal/src/branch/main/Subprocessors.md](https://codefloe.com/codefloe/legal/src/branch/main/Subprocessors.md)
- All changes: [https://codefloe.com/codefloe/legal/pulls/4](https://codefloe.com/codefloe/legal/pulls/4)

## What changed

**A full privacy notice instead of a summary.**  
The old page was a short summary.  
The new one is the complete notice required by Articles 13 and 14 GDPR: what we process, why, on which legal basis, how long we keep it, and how to exercise your rights.

**Retention periods, stated correctly.**  
The old summary said backups disappear within 30 days and IP logs within seven days.  
That was not accurate, and we are sorry it stood for so long.  
The actual schedules are now listed in section 7.  
In short: web access logs stay on the server for 30 days, archived copies are kept longer, SSH login logs for 365 days, and a deleted item can remain in an encrypted backup for up to about a year.

**Who processes data for us.**  
Providers are now named in a separate list, so every change is a public commit.  
The current providers are:

- [Hetzner](https://www.hetzner.com/) (Germany, one Kubernetes control-plane node in Finland) for hosting.
- [Scaleway](https://codefloe.com/codefloe/legal) for object storage (Paris), backups (Amsterdam), and e-mail (Paris).
- [bunny.net](http://bunny.net) (Slovenia) as a content delivery network for the forum’s uploads.

**Moves away from earlier providers.**  
Over the past days we moved all object storage and backups from Impossible Cloud to Scaleway, and deleted every copy left there and at Backblaze.  
Outgoing and incoming e-mail moved from Postale, whose mail servers are in the United States, to Scaleway in France.  
The documentation site moved from Statichost.eu to our own Pages servers.

**Every backup is now encrypted before it leaves our servers.**  
The storage provider only ever holds ciphertext.

**EU and UK representative.**  
devXY GmbH, which operates CodeFloe, is based in Switzerland.  
As required by Art. 27 GDPR, we have appointed Prighter as our representative in the EU and the UK; you can reach them through the Prighter privacy portal linked in the policy.

**Smaller fixes.**  
The imprint has devXY’s current address, and the Terms of Use no longer refer to an “association”, a leftover from the Codeberg terms they were adapted from.

## Questions

Write to [privacy@codefloe.com](mailto:privacy@codefloe.com), or reply here.