Privacy policy

Last updated: 4 November 2026

This policy explains what personal data the emexLabs Developer Portal (developer.emexlabs.org) processes, why, for how long, and what rights you have under the General Data Protection Regulation (GDPR).

1. Who is responsible

emexLabs
Konrad-Wolf-Allee 30
14480 Potsdam, Germany
Email: lucavmu@emexlab.de
Phone: +49 176 80170442

We are not required to appoint a data protection officer. For anything about your data, write to the address above.

2. Visiting the portal

When you open a page, your browser sends our web server technical data: your IP address, the date and time, the page requested, the HTTP status, the amount of data sent, the referring page and your browser's user agent. The server writes this to its access log. We need it to deliver the pages, to keep the portal secure and to find errors (Art. 6 (1) (f) GDPR, our legitimate interest being a secure service). Access logs are deleted automatically after 14 days at the latest.

To slow down password guessing and spam, the portal and the web server count requests per IP address for sign-in, sign-up and similar forms. These counters are only kept in memory and are gone after an hour at the latest.

The portal loads nothing from other servers: no external fonts, scripts, analytics, tracking or advertising.

3. Cookies

The portal sets only cookies it needs to work:

• portal_session: keeps you signed in. It holds a random value and expires after 14 days or when you sign out.
• portal_csrf: protects forms against being sent from other websites while you're signed out. It holds a random value and is deleted when you close the browser or sign in.

These cookies are strictly necessary for the service you ask for, so no consent is needed (§ 25 (2) no. 2 TDDDG). The processing is based on Art. 6 (1) (b) and (f) GDPR.

4. Your account

When you sign up we store your email address, the name or handle you choose, and your password as an Argon2id hash (we never see or store the password itself). We also store whether your email address is confirmed, your role, and, if you turn on two-factor sign-in, the secret your authenticator app uses. We send you emails needed for the account: the confirmation link, password resets, decisions about your requests, bug report updates and security notices.

Legal basis: Art. 6 (1) (b) GDPR (providing the portal you signed up for). Without an email address and a password we can't create an account.

Storage: until you delete your account. Confirmation links are valid for 48 hours, password reset links for one hour. Used or expired links are deleted.

5. Security log

For sign-ins, failed sign-ins and changes to your account or requests we store what happened, when, and the IP address. This helps us detect and investigate misuse of accounts (Art. 6 (1) (f) GDPR). Entries are deleted after 90 days. For each active session we also store when it started and the IP address it started from, until the session ends.

6. Organizations, signing keys and requests

We store the organization identifiers you ask for (with their display name and description), the public keys you register, their names, the ROM identifiers and the descriptions in your requests, and our decisions. If you prove ownership of a domain, the portal looks up a DNS record or a file on that domain. Legal basis: Art. 6 (1) (b) GDPR.

What becomes public: when a key request is approved, the public key, the key's name (your name or handle and the key name you chose) and its ROM identifiers are published in the Nyxian TrustStore. The TrustStore is a public file that every Nyxian device downloads, and we keep backups of earlier versions on our server. Published copies can't be recalled: if you revoke the key or delete your account, newer TrustStores no longer contain it, but copies of earlier ones remain on devices and wherever others saved them.

Storage on the portal: until you delete your account. Keys that are still in the TrustStore have to be revoked before that.

7. Bug reports

We store the bug reports you file (product, title, version, device, description), your comments and the files you attach. Only you, the emexLabs team and, for a report about a third-party ROM, the developer of that ROM can see them. They are notified about new reports and comments by email. For reports about Nyxian or emexOS, the report's title and product may also be posted to an internal emexLabs channel on Fluxer, without your name or email address.

Please don't put other people's personal data, passwords or private keys into reports or attachments.

Legal basis: Art. 6 (1) (b) GDPR (handling your report) and Art. 6 (1) (f) GDPR (fixing problems in our software). Storage: your reports and their files are deleted with your account. Comments and files you added to other people's reports stay there without your name.

8. Who receives data

• Our hosting provider, which runs the server the portal is on and processes data only on our behalf and under our instructions (Art. 28 GDPR).
• Our email provider, which delivers the emails the portal sends (Art. 28 GDPR).
• Developers of third-party ROMs, for bug reports about their ROMs (see section 7).
• Everyone, for the TrustStore contents described in section 6.
• Fluxer, for the notifications described in section 7.

We don't sell your data and don't use it for advertising. We don't make decisions about you based solely on automated processing: every organization and key request is decided by a person.

9. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17), its processing restricted (Art. 18), and to receive it in a portable format (Art. 20). Where we rely on legitimate interests (Art. 6 (1) (f)), you can object to the processing for reasons arising from your particular situation (Art. 21).

On your Account page you can download everything we store about you as a file and delete your account yourself. For anything else, write to the address in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority. The one responsible for us is: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

10. Security

All connections to the portal are encrypted (HTTPS). Passwords are stored as Argon2id hashes, sign-in links and sessions as hashes of random values. The portal runs as its own restricted user on the server, and uploaded files are stored outside the web server's directory.

11. Changes

If the portal starts processing data differently, we update this policy and change the date above. For changes that affect your account we tell you by email.