openpreference
GitHub Sign in

Privacy policy

Effective 2026-10-15. This policy covers the service at openpreference.org, operated by Late Summer Labs. It describes what the service actually does.

What this site is

openpreference.org is a hosted preference server. You create an account, record preferences you already repeat elsewhere (language, dietary restrictions, accessibility needs, and so on), and decide which of three tiers each preference is published to. Services you choose to work with can then fetch a signed copy of the preferences you have released to them. The protocols are the Open Preference Initiative specifications; the server code is open source under Apache-2.0.

What we store

Account. Your handle, your email address (and any secondary emails you add), the time each was verified, and whether the account has developer or admin status.

Passkeys. The public key, credential identifier, sign counter, authenticator identifier, transport hints and the label you give each passkey. We never receive a private key. We do not store passwords; there are none.

Preferences. Each preference's type, version, value, optional source, the tiers you have enabled for it (public, client, user) and any category groups you attach, plus the time it last changed.

Developer clients. If you register an OAuth client: its name, homepage, redirect URIs, the purpose statement you write, and a one-way hash of its secret. The secret itself is shown to you once and not retained in readable form.

Connected apps (authorizations). The standing grants you approve for user-tier access: which client, which preference types, the purpose and retention period the client declared, when you granted it, and when you revoked it.

Activity (access log). Every authenticated read of your preferences: the requesting client, its tier, the preference types it asked for, the purpose it registered or declared, the decision, the requester's IP address and the time. Public-tier reads are anonymous and are not logged against your account.

Sessions. A random session identifier (stored hashed), the IP address and browser string at sign-in, and timestamps. Sessions expire after 30 days or when you sign out.

Verification and sign-in tokens. Hashed, single-use, and expired within 15 to 30 minutes.

Admin audit log. Actions taken by the operator in the trust registry, with the acting admin's account and IP.

Server logs. The application logs request method, path, status and timing, without client IP addresses. The mail server logs the recipient address and delivery result of each verification or sign-in message. These logs rotate on the server within weeks.

Who can see your preferences

This is the point of the service, so it is worth being precise.

  • Public tier: anyone on the internet can fetch these without identifying themselves, and they may cache the signed bundle. Treat public-tier preferences as published.
  • Client tier: registered clients that hold a credential and are listed on our trust registry can fetch these, limited to the preference types in their credential's scope. Each read is logged to your access log with the client's registered purpose.
  • User tier: only clients you have explicitly approved on a consent screen, limited to the preference types in that approval, until you revoke it.

A preference with no tier enabled is private and never leaves the server. Your handle is discoverable through WebFinger whenever you have at least one public-tier preference; otherwise the discovery and preference endpoints answer as if the account did not exist.

Cookies and browser storage

Two cookies at most, both first-party and both set only in response to something you do:

Cookie Set when Purpose Lifetime
__Host-opi_session you sign in keeps you signed in; also carries the anti-forgery token for forms 30 days, rolling; removed at sign-out
op_theme you press the day/night toggle remembers that choice 1 year

Visitors who do not sign in or toggle the theme receive no cookies at all. Both cookies are strictly necessary for a function you asked for, so no consent banner is shown; under the ePrivacy rules that is the exemption we rely on. There are no analytics, advertising or tracking cookies, no analytics scripts, no fingerprinting, and nothing stored in local storage.

Third parties

  • Solid Systems LLC hosts the server in Toronto, Canada. They have physical and network access to the machine under their own terms.
  • Encrypted backups are taken nightly to two servers we operate, in Buffalo, New York and in the European Union. Backups are encrypted on the source server before transfer; the hosting providers for those servers cannot read them.
  • Let's Encrypt issues the site's TLS certificate. No personal data is involved beyond the domain name.
  • No other third party receives anything from your browser. All fonts, scripts and styles are served from this site; your browser makes no requests to Google or any other outside host when you use it.
  • Mail: verification and sign-in messages are sent from our own mail server on the same machine to the address you gave us.

We do not sell, rent or share personal data with anyone else, and we do not use it for advertising or profiling.

Retention

  • Account, passkeys, preferences, clients, connected apps and your activity log: for as long as your account exists.
  • Sessions: 30 days of inactivity, or until you sign out or delete a passkey.
  • Verification tokens: 15 to 30 minutes.
  • Server and mail logs: a few weeks.
  • Backups: encrypted snapshots are kept on a rolling schedule of up to two years. Data deleted from the live server persists in older snapshots until those expire.

Your controls

  • Export: /account/export downloads everything we hold about you as JSON.
  • Edit: change or remove any preference, passkey, secondary email, client or authorization from your account pages at any time.
  • Revoke: Connected apps (/account/authorizations) ends any standing user-tier grant and invalidates its tokens immediately.
  • Delete: /account/delete removes your account, preferences, clients, connected apps, activity log and sessions in one step. Signed bundles already fetched by others are outside our control.

If you want a copy, correction or deletion and cannot use these pages, email hello@openpreference.org and we will handle it within 30 days. Residents of the European Economic Area, the United Kingdom, California and other jurisdictions with data-protection law have the rights those laws grant, and we honour them regardless of where you live.

For people in the European Economic Area, the United Kingdom and Switzerland: Late Summer Labs is the data controller. We process account, passkey, preference, client and authorization data because it is necessary to provide the service you asked for (contract, GDPR Art. 6(1)(b)). We keep the access log and admin audit log, apply rate limits and security controls, and keep backups on the basis of our legitimate interest in running a secure, accountable service and of your interest in seeing who accessed your data (Art. 6(1)(f)). We send verification and sign-in email to operate your account (Art. 6(1)(b)). We do not process special-category data on purpose; if you choose to store a preference such as a dietary restriction that reveals religion or health, you do so on the basis of your explicit consent (Art. 9(2)(a)), which you withdraw by deleting the preference.

The server is in Canada, whose data-protection framework the European Commission recognises as adequate. The operator is in the United States and administers the server from there; one backup copy is held in the European Union and one in the United States. Where data reaches the United States it does so under the same policy, with the technical measures described below, and we do not disclose it to anyone there.

Your rights

Wherever you live you can access, export, correct and delete your data yourself from your account pages, and we honour the rights below for everyone, not only where the law requires it.

GDPR and UK GDPR: access, rectification, erasure, restriction, portability (the JSON export), objection to processing based on legitimate interest, and the right to lodge a complaint with your supervisory authority. We respond within one month. We do not make automated decisions with legal effect about you.

California (CCPA/CPRA): the right to know what personal information we collect (the categories above: identifiers, account credentials, preference content, and internet activity in the form of the access log), to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in the CPRA, we do not use it for cross-context behavioural advertising, and we have not done so in the preceding 12 months, so there is no opt-out to offer. We collect no sensitive personal information except what you choose to store as a preference, and we use it only to serve it as you direct. Requests can be made from your account pages or by email; we do not require an account to make a request and will verify your identity through the email address on file.

Other jurisdictions (for example Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act) grant comparable rights, which we honour the same way.

Security

Accounts use passkeys rather than passwords. All traffic is over TLS. Signing keys are encrypted at rest, secrets are hashed, session identifiers are hashed, and the server runs as an unprivileged process behind a host firewall. If we learn of a breach affecting your data we will tell you by email without undue delay, and notify the relevant supervisory authority within 72 hours where the GDPR requires it.

Children

The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

Changes

We will post changes here with a new effective date. If a change reduces your rights or expands what we collect, we will email account holders before it takes effect.

Contact

Late Summer Labs, the data controller, at hello@openpreference.org, or github.com/openpreference. We do not have a statutory obligation to appoint a data-protection officer or an EU representative at our size and volume of processing; the contact above handles all privacy requests.