Privacy policy
Controller
Matthias Rolke, c/o Postflex #7717, Emsdettener Str. 10, 48268 Greven, Germany. Contact details: see the imprint.
What is processed, and why
| Data | Where | How long | Legal basis |
|---|---|---|---|
| Request logs: time, URL, status code. Your IP address, to deliver the pages. | The hosting provider Render and its network (Cloudflare) | Logs: at most 14 days | Art. 6(1)(f) GDPR: running and securing the site |
| Salesforce username, org id, instance URL, OAuth tokens | Cookie connections in your browser (HttpOnly) |
30 days after the last login, or until logout | Art. 6(1)(b) GDPR: the service you asked for |
| Which org is the source and which the Dev Hub | Cookie roles |
as above | Art. 6(1)(b) GDPR |
| Login check (PKCE verifier) | Cookie pkce |
10 minutes | Art. 6(1)(b) GDPR |
| Org metadata (can contain names and email addresses, e.g. in email alerts and queues) | Passes through the server only, streamed between your browser and your org, never stored. Your browser converts it and keeps the files (Origin Private File System). | Server: until the request ends. Browser: until "Forget this browser". | Art. 6(1)(b) GDPR |
| Usernames, settings and cached org details | Your browser's local storage | until "Forget this browser" | Art. 6(1)(b) GDPR |
These cookies and the local storage are strictly necessary for the service (§25(2) no. 2 TDDDG), so no consent is needed. There is no analytics or tracking. There is no database: nothing about you is stored on the server beyond the server logs.
Recipients
- The hosting provider, under a data processing agreement: Render Services, Inc., 525 Brannan Street, Suite 300, San Francisco, CA 94107, USA.
- Cloudflare, Inc., which delivers the pages for Render.
- Salesforce: only your own org, which you logged in to.
Transfers outside the EU
Render and Cloudflare are US companies, certified under the EU-US Data Privacy Framework (Art. 45 GDPR), with standard contractual clauses as a fallback.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15-21 GDPR). You can do most of this yourself:
- "Forget this browser", at the bottom of the start page, deletes everything this site stored in your browser.
- Logout deletes the cookies but doesn't revoke the login at Salesforce, so Sfdx Auth URLs you copied keep working. To revoke it: in Salesforce, Setup → Connected Apps OAuth Usage (or your personal settings → Connected Apps) → "Salesforce CLI" → Revoke.
-
Salesforce keeps at most 5 logins per user for "Salesforce CLI", the app this site and
the
sfCLI share, and ends the oldest for a 6th. So logging in here can log out your CLI or an older Sfdx Auth URL ("expired access/refresh token"). Revoke the logins you no longer need there.
Right to complain
To a supervisory authority, e.g. the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
Other
There is no automated decision-making. The data is needed for the service to work. Links to other sites (GitHub, cal.com, mrolke.de): their own privacy policies apply once you follow them.