Privacy notice
Who is responsible
This instance of CommonLayer is operated by [Operator], [registered address] (the “operator”), which is responsible for the personal data processed through it. Contact: [privacy contact address]. [Add a data protection officer or representative if one is required.]
What is collected
| Data | Purpose | Basis [to be confirmed by counsel] |
|---|---|---|
| Account: email address, username, display name, optional profile fields; a password hash (Argon2id), never the password | Running your account, sign-in, transactional email (verification, password reset, invitations) | [Contract] |
| Sessions and API tokens: only hashes of the secrets are stored, with creation time and last use | Keeping you signed in, letting you review and revoke access | [Contract] |
| IP address and user agent of requests | Rate limiting, abuse prevention, and the audit log of security-relevant actions | [Legitimate interest: security of the service] |
| Contributions: amount, currency, date, contributor name and message if you give them, anonymity choice, receipt number | Recording and publishing funding, issuing receipts, refunds | [Contract / legal obligation for accounting] |
| Payment details | Handled by the payment provider; CommonLayer stores only provider references and display hints (for example card brand and last four digits) | [Contract] |
| Maintainer profile, agreement acceptance, payout destination reference and tax status | Assignments, eligibility and payouts | [Contract / legal obligation] |
| Private security reports and messages | Coordinated handling of vulnerabilities; stored encrypted | [Legitimate interest] |
| Notification preferences, follows, webhook endpoints | Sending the notifications you ask for | [Contract] |
The portal loads no third-party scripts, analytics or advertising trackers, and serves its fonts itself.
What is public
Some information is public because transparency is the purpose of the platform:
- Your username, display name, avatar, bio and approved public contributions.
- Contributions you make: amount, date, your name and your message — unless you choose to contribute anonymously, in which case your name is never shown.
- For maintainers: assignments, the amount of each slot, whether a month was paid, held or forfeited and the published explanation, and the eligibility state per period.
- For public organizations: name, logo, funded projects and totals.
Never public: email addresses, sessions and tokens, billing details, payment references, payout destinations, tax status, private evidence notes, appeals, private follows, embargoed findings and private security reports, organization members and notes.
Cookies and storage
| Name | Purpose | Lifetime |
|---|---|---|
__Host-cl_session | Keeps you signed in (strictly necessary). HttpOnly, Secure, SameSite=Lax. | Until you sign out; at most 14 days idle and 90 days in total |
cl_csrf | Protects forms against cross-site request forgery (strictly necessary) | Same as the session |
cl-theme (local storage) | Remembers your light/dark theme choice | Until you clear it |
No cookies are used for analytics or advertising.
Service providers
The operator uses service providers to run this instance: [hosting provider], [object storage provider], [email delivery provider] and [payment providers]. If you sign in with GitHub or another identity provider, that provider shares your basic profile with CommonLayer. [List providers, their locations and the safeguards for international transfers.]
Retention
Account data is kept while your account exists and deleted or anonymised after it is closed, except where records must be kept: the funding ledger is append-only and accounting records are retained for [statutory period]; the audit log is retained for [period]. Expired sessions and tokens are removed automatically.
Your rights
Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to complain to a supervisory authority. Most profile data can be changed in your account settings; for anything else, contact [privacy contact address].
Changes
Material changes are announced on this page and, for account holders, by email before they take effect. Last updated: [date].