Privacy &
cookie policy

Classifyre is an open-source project operated from Austria, European Union. For the websites described below we are the data controller within the meaning of the General Data Protection Regulation (GDPR).

We have not appointed a Data Protection Officer; we are not required to. Write to the address above for anything covered by this policy.

This policy covers the websites we operate:

• www.classifyre.com — this site, including the blog.
• docs.classifyre.com — the documentation site.
• demo.classifyre.com — the public read-only demo, covered in section 08.

It does not cover the Classifyre software itself. Classifyre is Apache-2.0 licensed software that you install and run on your own machines or in your own cluster. When you do that, the deployment talks to your infrastructure and not to us: we receive no telemetry, no scan results, no documents, and no user accounts from it. For your own deployment, you are the controller and we are not involved in the processing at all.

Server logs. Like any web server, our hosting provider records requests: IP address, time, the page requested, referrer, and browser user-agent. These are used to keep the site up and to spot abuse, and are not combined with the analytics data below.

Analytics, if you accept. If you accept analytics cookies we record which pages are read, in what order, for how long, roughly where from (country level), and on what kind of device. We use this to decide what to write and what to document. We do not build advertising profiles, we do not run ad networks, and we do not sell or rent any of it.

We do not ask for an account, and there is no login on these sites. If you email us, we of course have your email — we keep the correspondence and nothing more.

Essential entries are set without asking, because they are what make your own choices stick — that is the narrow exemption the ePrivacy Directive allows. Analytics cookies are set only after you press Accept.

You can change your mind at any time, and it takes one click:

Your browser can also block or delete cookies wholesale, and Google publishes a Google Analytics opt-out add-on. Declining costs you nothing here: every page works identically either way.

• Consent (Art. 6(1)(a) GDPR) for analytics cookies and everything they collect. We ask before anything loads, Decline is one click and sits beside Accept, and refusing has no consequence for you.
• Legitimate interests (Art. 6(1)(f) GDPR) for server logs and abuse prevention — the interest being keeping a public website available and unattacked.
• Legal obligation (Art. 6(1)(c) GDPR) where the law requires us to keep or produce something.

We keep this list short on purpose. Every name here is a processor acting on our instructions under Art. 28 GDPR.

• PostHog — product analytics, configured on its EU region, so those events stay in the European Union. See the PostHog privacy policy.
• Google Analytics 4 (Google Ireland Ltd.) — page-view statistics. Google may transfer data to the United States under the EU–US Data Privacy Framework and standard contractual clauses. See how Google uses data from sites that use its services.
• Our hosting provider — serves the pages and keeps the request logs described in section 03.

Nobody else. We do not sell personal data, we have never sold personal data, and there are no advertising or data-broker integrations on these sites.

• Analytics data: up to 14 months in Google Analytics, up to 12 months in PostHog, after which only aggregate counts remain.
• Server logs: typically 30 days, longer only while investigating a specific incident.
• Email you send us: as long as the conversation is live, and afterwards only where we have a reason to keep it.

Your own installation. A Classifyre instance you run — desktop app, Kubernetes, or otherwise — does not phone home. There is no licence check, no usage beacon, and no crash reporting to us. Whatever it scans stays in your database, and you are the controller for it. The software is provided under the Apache-2.0 licence, which includes its warranty and liability terms; nothing on this page adds to them.

The public demo. demo.classifyre.com is a deliberately public, read-only instance we operate so people can look around before installing anything. It is a shop window, not a vault: treat everything in it as public, and do not upload real personal data, credentials, or anything confidential to it. We may reset it without notice.

Under the GDPR you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or hand it over in a portable form. Where we rely on consent, you can withdraw it at any time — using the button in section 04 — without affecting what was lawful before you did.

Email [email protected]. We answer within one month. Requests are free unless they are manifestly excessive.

You also have the right to complain to a supervisory authority. In Austria that is the Datenschutzbehörde; elsewhere in the EEA, your national authority is listed by the European Data Protection Board.

These sites are documentation and marketing for infrastructure software; they are not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, tell us and we will delete it.

When what we collect changes materially, we update this page, change the date at the top, and reset the stored consent so the banner asks again rather than relying on an answer you gave about something else. Editorial fixes do not trigger that.

Last updated: 4 August 2026.