Privacy Policy

1. Introduction

This Privacy Policy describes how Synfire ("we", "us", "our") collects, uses, and protects information when you use the Synfire registry ("Service").

2. Information We Collect

Account Information

When you create an account, we collect your username, email address, and authentication credentials. Organization ownership is stored to manage access control.

Usage Data

We collect information about how you interact with the Service, including API requests, search queries, and download activity. This data is used to operate and improve the Service.

Published Content

Models, metadata (nir-card.json), and release notes you publish are publicly accessible by design. Author information included in metadata is displayed publicly.

3. How We Use Information

• To operate and maintain the registry
• To authenticate users and manage access
• To provide search and discovery features
• To compute download statistics and popularity metrics
• To detect and prevent abuse
• To communicate important service updates

4. Data Sharing

Published models and their metadata are publicly available. We do not sell personal information. We may share information with service providers who help operate the Service (e.g., cloud hosting) and when required by law.

5. Data Security

We implement security measures including encrypted connections (TLS), hashed passwords, secure token storage, and rate limiting. API tokens use the synfire_ prefix and are stored using OS-level secure credential stores on client devices.

6. Data Retention

Account data is retained while your account is active. Published releases are immutable and retained indefinitely as part of the public registry. Tombstoned releases are hidden but may be retained for audit purposes.

7. Your Rights

You may request access to, correction of, or deletion of your personal data by contacting us. Note that published model releases are immutable and cannot be retroactively removed, though they can be tombstoned.