Privacy Policy

Last updated: June 2026

1. Who we are

OpenCan is an open-source customer feedback management platform. This policy explains what personal data we collect, why we collect it, and how we handle it.

2. Data we collect

We collect only what is necessary to provide the service:

  • Account information — when you sign in via Google or GitHub we receive your email address, display name, and avatar URL from that provider. If you sign up with email and password we store your email and a bcrypt-hashed password; your plaintext password is never stored.
  • Content you create — posts, comments, and votes you submit on feedback boards.
  • Usage data — standard web server logs (IP address, browser, pages visited) retained for up to 30 days for security and debugging purposes.

We do not collect payment information, track you across third-party sites, or use advertising cookies.

3. How we use your data

  • To authenticate you and maintain your session.
  • To send transactional emails — status-change notifications and changelog updates — that you can opt out of in your account settings.
  • To let administrators moderate feedback submitted on their boards.
  • To detect and prevent abuse or unauthorised access.

We do not sell, rent, or share your data with third parties for marketing.

4. Third-party services

We use the following sub-processors:

  • Google / GitHub OAuth — used for sign-in only. We do not receive access to your Google Drive, GitHub repositories, or any other data beyond your public profile.
  • Resend — transactional email delivery. Your email address is passed to Resend solely to send notifications you have requested.
  • PostgreSQL database — all application data is stored in a PostgreSQL instance that you or your administrator controls.

5. Data retention

Your account data is retained for as long as your account exists. You may request deletion of your account and associated data at any time by contacting an administrator. Posts and comments authored by deleted accounts have their author reference removed; the content may remain visible if it was submitted to a public board.

6. Security

We use industry-standard measures including HTTPS in transit, bcrypt password hashing, HMAC-signed webhook payloads, and session invalidation on logout and role changes. No system is perfectly secure; please use a strong, unique password and enable OAuth sign-in where possible.

7. Your rights

Depending on your jurisdiction you may have the right to access, correct, export, or delete your personal data. To exercise these rights please contact the administrator of the OpenCan instance you are using.

8. Changes to this policy

We may update this policy from time to time. Material changes will be announced via the changelog. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

9. Contact

Questions about this policy? Contact the administrator of your OpenCan instance or open an issue on the OpenCan GitHub repository.