Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# This file lists processing purposes and the personal data gathered by
# Castopod.
# It is intended for hosting providers who want to provide a service
# based on Castopod, helping them to comply with GDPR requirements. Note
# that the services powered by Castopod may collect more data, HTTP logs
# in particular. As a hosting provider, you must inform your users of their
# rights and how their data are used and protected.
purposes:
- description: Connect users to their accounts
lawfulness: legitimate interest
data:
- field: username
required: yes
visibility: authenticated users
description: |
The username is used to identify users during the login process.
The username is only required for users accessing the admin area.
mitigation: The username does not have to be a real or known identity.
retention: forever
- field: user e-mail address
required: yes
visibility: administrators
description: |
The e-mail address is used for administrative purposes, to identify users
during the login process and in case of forgotten password.
retention: forever
- field: password
required: yes
visibility: private
description: |
The password is used to check the identity of users during the login
process.
mitigation: |
Only hashes (using the Argon2 key derivation function) of the passwords
are stored in the database (but they transit over the network).
retention: forever
- description: Claim ownership of a podcast
lawfulness: legitimate interest
data:
- field: Podcast e-mail address
required: yes
visibility: public
description: |
The podcast e-mail address is used to claim podcast ownership on other
platforms (such as Apple Podcasts).
mitigation: The e-mail can be generic.
retention: forever