Privacy Policy

Tangled is built on the AT Protocol, an open network where much of your data is public by design. Your profile, repositories you make public, issues, pull requests, comments, stars and follows are published as records that anyone on the network can read, including other services that are not run by us.

Your account is hosted on a Personal Data Server (PDS). If we host your account (a tngl.sh handle), we are responsible for that data. If your account is hosted by another provider, such as Bluesky or your own server, that provider's privacy policy governs the data it stores. The same applies to knots and spindles you run yourself.

Information you give us

• Your handle, email address and password, if we host your account
• Email addresses you add for notifications and commit attribution
• Profile information, SSH and signing keys you choose to add
• Repositories, issues, pull requests, comments and other content you publish
• CI workflows you run on our spindles, and their logs
• Your email address, if you sign up for the newsletter
• Data you import from GitHub, if you connect your GitHub account

Information collected automatically

• IP addresses, browser and device information, and request logs
• Information about how you use the Service, such as the actions you take

We use your information to:

• Provide, maintain and secure the Service (to perform our contract with you)
• Send you account emails and the notifications you have turned on
• Prevent spam, abuse and fraud (our legitimate interest)
• Understand how the Service is used so we can improve it (our legitimate interest)
• Send you the newsletter, if you subscribed (your consent)
• Comply with legal obligations

We do not sell your personal data, and we do not use it for advertising.

We use the following service providers to run the Service. They process personal data on our behalf and under our instructions:

Beyond the providers above, we share data only:

• With the AT Protocol network, as part of how it works: for example, your handle is resolved through public directory services such as plc.directory and Bluesky's public API when you sign in
• With search engines, by notifying them of new or deleted public pages, such as your profile and public repositories
• When required by law or legal process
• To protect the rights, property or safety of Tangled, our users or the public
• In connection with a merger, acquisition or sale of assets, subject to appropriate protections

Our core services run in the European Union. Some of our providers are located in, or may process data in, other countries, including the United States. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

We keep personal data for as long as your account is active, or as long as we need it to provide the Service, and longer only where the law requires it. When you delete your account, we delete the data we hold about you, except where we must keep it for legal reasons.

If you connect GitHub to import repositories, we delete your stored GitHub credentials within an hour. Records you have published to the AT Protocol network may already have been copied by other services, which we cannot delete.

We use appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure or destruction. No method of transmission or storage is completely secure. To report a security issue, contact security@tangled.org.

Under the GDPR and other applicable laws, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Have your data deleted
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent

To exercise these rights, contact us at team@tangled.org. You also have the right to lodge a complaint with a supervisory authority; in Finland, this is the Data Protection Ombudsman (tietosuoja.fi).

We use cookies that are necessary for the Service to work, such as keeping you signed in and remembering which account you are using. We do not use advertising cookies. When you sign up, we use Cloudflare Turnstile to prevent spam, which may process information about your browser.

The Service is not intended for children under 16. We do not knowingly collect personal data from children under 16, and if we learn that we have, we will delete it.

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the date above, and for significant changes we will let you know in advance.

If you have questions about this Privacy Policy or how we handle your data, contact us at team@tangled.org. See also our Terms of Service.