Brevard CreekLabs

Appendix A

Privacy

What we collect when you use brevardcreek.com and the platform behind it, why we hold it, and what you can make us do with it. It is short because there is not much of it.

Revised 1 September 2026

  1. Who we are

    Brevard Creek Labs is the controller of the personal data described here. Reach us through the contact form.

  2. If you only visit this website

    Our web server keeps a standard access log: the requesting IP address, the time, the page requested, the response status, the referring page and the browser’s user-agent string. We use it to keep the site running and to see abuse. There are no analytics scripts, no advertising tags and no third-party trackers.

    We set no cookies on the public pages. The chat widget in the corner keeps one item in your browser’s local storage — a key identifying your conversation, so that it is still there if you reload the page. Clearing site data removes it.

    If you press “I have this problem too” on the problem board, we store your vote together with a salted, one-way hash of your IP address. It exists for one reason: so the same person cannot vote a hundred times. The salt is random, kept on the server and never published, so the hash cannot be turned back into an address — not by anybody else and not by us. It is not joined to your page views, it is not shared, and it records nothing about you except that a vote on that one problem has been counted. This is the only per-visitor value we keep.

  3. If you have an account

    • Your email address and display name, because an account needs both.
    • A password, stored only as a PBKDF2 hash. We cannot read it.
    • The content you create: messages, documents, files, notes and boards.
    • Records of when you signed in, and from which IP address.
    • Call records — who called whom, when, and for how long. Not the audio or video, which never passes through our servers when a direct connection between the two browsers is possible.

  4. Cookies

    We set two, and only after you sign in. The first is the session itself: HTTP-only, Secure, scoped to brevardcreek.com, and the only thing that actually authenticates you. The second carries no information at all — it is a flag saying that a session exists, readable by the page so that it can render the right thing before it has asked. Setting it by hand gets you nothing. Both are cleared together when you sign out.

    Both are strictly necessary for the service to work, so no consent banner is shown for them. We do not use cookies for analytics or advertising.

  5. Why we are allowed to hold it

    For account data and content: to perform the contract we have with you. For access logs and security records: our legitimate interest in keeping the service available and unabused. Where a legal obligation requires us to keep something, that obligation.

  6. Who else sees it

    We do not sell personal data and we do not share it for advertising. It is disclosed only to the providers that run the service beneath us, to anyone you deliberately share it with inside the platform, and where the law compels us.

    Those providers are DigitalOcean, who host the servers, and Brevo, who carry outbound email. Everything else — the application, the databases, the file storage and the servers that set up calls — we run ourselves.

  7. Where it is held, and for how long

    On servers in the United States. Account data and content are kept for as long as the account exists; when an account is deleted, its content goes with it. We keep the fourteen most recent daily backups, after which the oldest is overwritten.

  8. What you can ask for

    A copy of your personal data, a correction to it, its deletion, or an objection to how we are using it. Write to us through the contact form and we will respond within 30 days. Depending on where you live you may also have the right to complain to a data protection authority.

  9. Security

    Traffic is encrypted in transit. Passwords are hashed, never stored in a form we can read. Access to production systems is limited to the people who operate them. No system is perfect; if you find a problem, tell us through the contact form and we will treat it seriously.

  10. Children

    The platform is a business product and is not directed at children under 16. We do not knowingly collect their data.

  11. Changes

    If this policy changes materially we will say so on this page and update the date at the top. Continuing to use the service after a change means the updated policy applies.