Privacy
What this service holds about you, why, and how to get rid of it. Written to be read, not to be survived.
Who is responsible
The operator of fyrhaven.com — see the imprint for the name and address. Contact for anything on this page: hello@fyrhaven.com.
What is stored
- Account: your email address, a password hash (scrypt — the password itself is never stored), your plan and its expiry date, and whether the plan was paid.
- Your records: the projects, private notes, consent records and change history the plugin keeps — encrypted at rest with a key held by this service.
- Licences: the installation key of each self-hosted server you activated, so a licence cannot be silently copied.
- Orders: what you bought and when. Payment details are held by Stripe, not here.
- Operational: request counts per minute and byte usage, to enforce the limits and to know what the service is doing.
Why (legal basis)
- To perform the contract: the account, the records, the licences, the invoices (Art. 6(1)(b) GDPR).
- Legitimate interest: keeping the service secure and working, which is what the rate limits and logs are for (Art. 6(1)(f)).
- Legal obligation: bookkeeping for paid orders (Art. 6(1)(c)).
Cookies and tracking
There are none. No analytics, no advertising pixels, no third-party scripts. The
site keeps your session token in this browser's sessionStorage and nothing else;
closing the tab signs you out of the website (the plugin's own credential is held by the webmail,
not by us).
Who else sees it
- Stripe — processes payments and holds the card data.
- The hosting provider — the machine this runs on, inside the EU.
Nothing is sold, and nothing is shared for advertising.
How long
Records live until you delete them or close the account. Closing the account deletes the records and the wrapped key that makes them readable, which is a real erasure rather than a flag. Invoices are kept as long as bookkeeping law requires (seven years in Sweden).
Your rights
Access, correction, deletion, portability, restriction and objection — all by writing to the address above; no form, no account needed. The plugin itself carries a GDPR toolkit (subject exports, consent records, erasure) for the contacts you control. If you think this service has handled something wrongly you can complain to IMY, the Swedish authority.
One honest caveat
Records are encrypted at rest with a key this service unwraps in order to serve them, so the operator can read them. That is the price of a server-held key and it is stated here rather than implied away; a customer-held key is the thing that would change it.