1. About this personal project
This MyLibrary instance is a personal project, not a company. This notice explains the software’s data handling and access boundaries. Applicable privacy rights and legal obligations are not waived by describing it as a personal project.
For questions, privacy requests, suspected administrator misuse or a security report, contact the project operator or the person who provided your access. Include only what is needed to identify the account or conversation; never send your password.
2. What information is processed?
- Account: name, email address, optional profile image, a salted password hash, account role/status, registration dates and session-revocation information.
- Library: saved URLs, titles, descriptions, private notes, tags, categories, favorites, archive state, collection membership, code snippets, prompts, AI/provider/model labels and preferences. Content can contain personal information you choose to include.
- Chat: participant email addresses, requests and blocks, messages, shared snapshots, timestamps, your unread-message state, attachment names/types/sizes and uploaded file bytes.
- Security: successful, failed and blocked authentication/account events, timestamps, email/account references, browser information and safe outcome codes. API logs contain method, URL path, status, duration and an account reference where available. Client IP addresses are recorded when the operator’s trusted proxy is configured to provide them.
- Administration: records of administrator actions, affected account references, dates, relevant action metadata and IP context. Terms acceptance records contain the accepted document versions, account reference and time.
Security logs exclude passwords, password hashes, message bodies, session cookies and reset/CSRF tokens. Library content itself remains stored as content, rather than as a security log.
3. Why is it used?
Account management, storing your library, sending the messages you request, uploads, exports and account recovery are necessary to provide the service you request (GDPR Article 6(1)(b)). Protecting accounts, limiting abuse, investigating incidents and controlling administrator access serve the operator’s legitimate interests (Article 6(1)(f)); these interests must be balanced against your rights. A specific legal obligation may require processing under Article 6(1)(c).
If someone addresses a chat to your email before you have an account, the operator receives that address and the shared content from the sender. It is used to route the requested conversation and prevent misuse, on the basis of legitimate interests. No invitation email is sent. You can contact the operator to object or request removal without creating an account.
Required account information is needed to provide access. Other library content and sharing are your choice. Agreement to the Terms is not blanket consent to unrelated data processing.
4. Administrator and server access
Application administrators can inspect and export another user’s library and profile, review security/activity logs, revoke sessions, disable or delete accounts, and request password-reset delivery. Administrator workspace access can also expose uploaded profile/background images and allow changes to library content. Access through the provided administration tools is recorded in administration/API logs.
Administrators should use this access only where necessary for support, security, abuse handling, maintenance or a lawful request. The existence of access does not give permission for unrelated browsing, reuse or disclosure. If you believe it has been misused, contact the operator or your data-protection authority.
Chat APIs require conversation membership and reject administrator impersonation; the application does not provide a general administrator chat browser. However, people with server, database, backup or filesystem access can technically access stored chats, prompts, resources and uploaded files. They are not end-to-end encrypted. Passwords are stored as hashes and are not displayed as readable passwords.
Avoid storing passwords, API keys, highly sensitive personal information or content you are not permitted to disclose to the operator.
6. Hosting, providers and transfers
Library records and messages are stored in the instance’s database. Uploaded files are stored on its server. The operator’s hosting infrastructure, account-recovery email provider and any restricted recovery copies can process the information needed to provide those services. No particular provider, storage country or international-transfer arrangement is promised in this notice.
Providers may process data to host the service, deliver requested account-recovery messages or maintain backups. Where GDPR requires it, the operator must have suitable processor agreements and safeguards for transfers outside the EEA. Ask the operator for the applicable details and a copy or description of those safeguards.
7. Retention and deletion
Your account, library and uploaded content are retained to provide your workspace until you delete them or the operator removes them for a justified reason. Settings provides library exports and account deletion. Library JSON exports cover library items, not a complete copy of chat history, attachments or security records; request additional personal data from the operator when needed.
Deleting an account removes its library and uploaded files and retires its chat access. Text messages and shared snapshots remain as copies in other participants’ conversation history; those participants may also have saved independent library copies. Blocking stops future incoming messages in that conversation but does not erase existing history. Contact the operator for a request concerning remaining personal information; relevant rights and lawful retention interests must be assessed.
Authentication and API request logs use a 30-day retention threshold with periodic cleanup. Administrator audit records must be reviewed and removed by the operator when no longer necessary for security, accountability or legal claims; there is currently no automatic expiry for that log. Deleted-account email snapshots can remain in authentication logs during their retention period. Unused reset tokens expire after 30 minutes; old unsent chat uploads are removed on the account’s next upload after one day.
There is currently no committed backup schedule or retention period and no promise that deleted or lost data can be restored. If recovery copies are introduced, the operator must define their purpose, access and retention and update this notice. Restoring a recovery copy requires relevant deletion requests to be reapplied. Legal holds must be limited to what is necessary and justified. Keep independent exports of important content.
8. Your choices and rights
Depending on the applicable conditions, you can request access and a copy, correction, erasure, restriction, portability and object to processing based on legitimate interests. Where processing actually relies on consent, you may withdraw it without affecting previous lawful processing. The operator may need proportionate information to verify your identity and should normally respond within one month; a justified extension must be explained.
You can contact the operator without an account. If the response does not resolve your concern, you may complain to the Autoriteit Persoonsgegevens in the Netherlands or the competent authority in your country. These terms do not remove those rights.
The application does not make automated decisions with legal or similarly significant effects or use advertising profiles. Automatic rate limits protect access against abuse; contact the operator if a restriction appears incorrect.
9. Cookies and changes
See the Cookie & storage notice for authentication cookies and demo browser storage. The version and update date above identify this notice. Material changes should be brought to users’ attention before new processing starts. Existing accounts are not treated as having accepted a new contract merely because this page was published.