Privacy Policy
This policy says exactly what the mc package registry stores about you, why, for how long, and how to make it stop. It is short because the service holds little: there is no password, no tracking, no advertising and no analytics anywhere on this site.
1. Who is responsible
The controller ("controlador", art. 5 VI LGPD) is the minicompiler organisation, through its owner, in Brazil. Requests about your data, including the ones under section 6, go to legal@minicompiler.dev. There is no separately appointed data protection officer; that address reaches the person who decides.
2. What is stored
This is the whole list. Every item is a column in a table this service owns.
2.1 Your account
- GitHub numeric id -- the stable identifier of the account you signed in with;
- GitHub login (your user name);
- display name, as GitHub reports it, or your login when it is empty;
- avatar URL -- the address of the picture, not the picture; your browser fetches it from GitHub;
- created_at, the moment the account row was written;
- state (
pendingoractive) and, if applicable, the moment the account was suspended.
The service asks GitHub for the read:user scope and nothing else. It never sees your
e-mail address unless you write to us, it never sees your repositories' contents beyond what is
public, and it never receives your GitHub password. The access token GitHub issues during a login
is used once, in the same request, to read your public profile, and is not stored.
2.2 Sessions
- the SHA-256 hash of the session token. The token itself lives only in your browser's cookie: a dump of this table cannot be used to sign in as you;
- creation and expiry timestamps;
- the IP address the sign-in came from;
- the User-Agent string your browser sent, at most 255 bytes.
2.3 Acceptance of the legal documents
- which document (terms, privacy, packages), which version of it, and when;
- the IP address and the User-Agent of the request that accepted it.
These rows are the record that the commitment was made. They are never updated and never deleted; after an erasure request they remain, detached from your identifying data (section 6).
2.4 Audit rows
- an action name the server chose (for example
login.ok,logout.ok,accept.terms), a subject and a detail -- all of them written by the server, never text you supplied; - the account the action belongs to, when there is one;
- the IP address of the request and its timestamp.
2.5 Rate-limit rows
One row per (route, address) with a token count and a timestamp. The address is part of the row's key. Rows are deleted once they are an hour old, which happens on the next write that touches the table.
2.6 Packages
The repositories you register and the versions that are published are public: the package name, the description, the git URL, the tags, the commits, the hashes, the dependency lists and the validation reports are shown on the site and served in the registry index. Do not put anything in a package's metadata that you do not want published.
2.7 Server logs
One line per request on the server's standard output: the client address, the method, the request
target (with the values of code, state, token,
access_token and client_secret replaced by [redacted]), the
status and the memory the request used. No cookie, no header, no request body and no
token is ever logged. Logs are collected by the deployment platform on the same server
and are kept for at most 30 days.
3. Why, and on what legal basis
| Data | Purpose | Legal basis (LGPD) |
|---|---|---|
| Account | to identify who registered a package and to let you sign in | art. 7 V -- performance of a contract with you |
| Sessions | to keep you signed in and to let you revoke a session | art. 7 V -- performance of a contract |
| Acceptances | to prove which documents you accepted, and when | art. 7 II -- compliance with a legal obligation; art. 7 VI -- exercise of rights |
| Audit rows | security, abuse investigation, moderation decisions | art. 7 IX -- legitimate interest in the security of the service |
| Rate-limit rows | to stop one address exhausting the service | art. 7 IX -- legitimate interest |
| Package metadata | to run the registry | art. 7 V -- performance of a contract |
| Server logs | to operate and debug the service | art. 7 IX -- legitimate interest; Lei 12.965/2014 art. 15 for access records |
For users in the European Union, the corresponding GDPR bases are art. 6(1)(b) (contract), art. 6(1)(c) (legal obligation) and art. 6(1)(f) (legitimate interests: security and abuse prevention). No processing here relies on consent, because none of it is optional to the service working -- which is also why there is no cookie banner (section 5).
4. How long it is kept
- Sessions: 30 days from creation, or until you sign out, whichever is first. A signed-out session's row is deleted, not expired in place.
- Rate-limit rows: at most one hour.
- Server logs: at most 30 days.
- Audit rows: 24 months, after which the address is removed and the row is kept without it. Brazilian internet law (Lei 12.965/2014, art. 15) requires access records of this kind to be kept for at least six months.
- Acceptance rows: for as long as the service exists, as the record of the commitment; detached from your identity after an erasure request.
- Account: until you delete it.
- Published package metadata: indefinitely, because lock files depend on it.
5. Cookies
There are exactly two, both strictly necessary, both first-party, neither of them a tracker:
| Name | What it is | Lifetime |
|---|---|---|
__Host-mcs |
your session token; the server stores only its hash | 30 days |
__Host-mcp |
a signed value that ties a sign-in you started to the answer GitHub sends back; it is what makes a forged login callback fail | 10 minutes |
Both are Secure, HttpOnly and SameSite=Lax, and both carry
the __Host- prefix, which stops any other host from setting them. Neither is set
until you start a sign-in.
There is no consent banner, and that is deliberate. Under the LGPD and under the
ePrivacy rules a banner is required for cookies that are not strictly necessary -- analytics,
advertising, profiling. This site sets none. It also loads no third-party script: the content
security policy it sends allows scripts only from its own origin, and the only external request a
page makes is your browser fetching your avatar from GitHub's image host on the
/me page.
6. Your rights, and how to exercise them
Under the LGPD (art. 18) and, where it applies, the GDPR, you may ask for:
- confirmation and access -- what is held about you;
- correction of incomplete or out-of-date data. Your name, login and avatar come from GitHub: correct them there and they are refreshed at your next sign-in;
- portability -- a machine-readable export of everything above;
- erasure ("delete my account");
- information about with whom data is shared (section 7);
- objection to processing based on legitimate interest, and review of a decision taken about you.
Access, export and deletion are available from /me as they are built; every one of
them can be requested today by writing to
legal@minicompiler.dev from an address you can prove
belongs to the account, or by opening the request from the signed-in account. Answers are given
within 15 days, which is the LGPD's own deadline for the full answer, and
usually much sooner.
What an erasure leaves behind, and why. Your login, name, avatar URL, sessions, tokens and the addresses in your audit rows are removed. Two things stay: the rows of the versions you published, attributed to "a deleted account" with no personal data in them, because every lock file that pins one of them depends on it; and the acceptance rows, detached from your identity, because they are the record that the documents were accepted. If you believe your rights were not respected you may complain to the Autoridade Nacional de Proteção de Dados (ANPD), or to your local supervisory authority in the EU.
7. Who else touches the data
| Processor | What for | Where |
|---|---|---|
| GitHub, Inc. | the sign-in itself (OAuth) and the public repositories the validator reads. GitHub learns that you signed in to this service. | United States |
| Hostinger | the virtual server the service runs on: the database, the logs and the archives are on a machine rented from them. | European Union |
| Cloudflare, Inc. | optional, in front of the site, for protection against denial-of-service attacks. When it is enabled it sees the addresses and the requests of every visitor. This page says so whether or not it is enabled today. | global network |
Nothing is sold, rented or shared for advertising. Data is disclosed to an authority only under a valid legal order, and where the law allows it you are told.
International transfers. Using GitHub for the sign-in and, when enabled, Cloudflare for protection means personal data crosses borders. Those transfers rest on art. 33 IX LGPD (necessary for the performance of the contract you asked for) and, for EU users, on the transfer mechanisms those providers publish.
8. How it is protected
- Every connection is over TLS; the site sends HSTS and a strict content security policy.
- Session tokens are 32 random bytes and are stored only as a SHA-256 hash.
- Two secrets are compared without an early exit, so a comparison cannot be timed.
- Every database value is bound as a parameter; no query is built out of a value.
- Package validation runs in a sandbox with no network and no view of the host.
- Each request is answered by its own short-lived process, so a fault costs one request.
No system is perfect. If a breach affecting your data happens, the ANPD and the affected users are notified as art. 48 LGPD requires. To report a vulnerability, read the security policy.
9. Children
The service is not directed at children. An account requires a GitHub account, whose own terms set a minimum age. If you believe a child's data is here, write to legal@minicompiler.dev and it will be removed.
10. Changes to this policy
This document carries a version, which is its effective date. When it changes you are asked to read and accept the new version the next time you sign in, and the acceptance is recorded with its version. The change log below says what changed.
Change log
- 2026-09-06 -- first version, effective from the day the login opened.