Privacy notice
What obscenter.site keeps about you: your account and how you sign in, the address you leave in “Stay in touch”. Last updated 29 October 2026.
Accounts
Who
the operator of Obscenter (obscenter.site) is responsible for the data about your account. Contact: info@obscenter.site.
What we keep
Your email address, your password as a salted one-way hash (never the password itself), the name of your organisation, who is a member of it and with what role, and the settings you choose — which machines and applications you want to be told about, and how.
A record of every attempt to sign in: when, the network address and the approximate place it came from, the browser and operating system, and whether it worked. It is there to protect your account — to slow down and show anybody guessing a password — and it is kept for 180 days.
If you ask for a link to choose a new password, a record of that request: a random token that we keep only as a one-way hash, which account it is for, when it was asked for, the network address it was asked from, and when it was used. The link works for 60 minutes and once; a newer request replaces it. The record is kept for 30 days after it was asked for, then deleted, to slow down and show anybody asking for links to somebody else's account.
A record of accepting the terms of service — when the account was made, when you open or join an organisation as its owner or admin, and when you accept a changed version: which version, when, the network address and browser it came from, and the words of the boxes ticked. It is the evidence of our agreement, kept for as long as the contract lasts and five years after it ends (our legitimate interest in being able to prove what was agreed). A copy of the accepted terms is mailed to you.
Cookies
Two, both needed for the service to work, neither for advertising or tracking: rum_sess keeps you signed in and lasts 30 days from your last visit; obs_oauth exists for at most ten minutes while a Google sign-in is under way, to make sure it is finished in the browser that started it. Your choice of light or dark theme is kept in your browser’s local storage.
Why
To provide the service you signed up for (the contract between us), to keep accounts safe (our legitimate interest in security), and to send the mail the service consists of: confirming your address, invitations from your colleagues, links to choose a new password when you ask for one, and the alerts you or your organisation set up.
Sharing
We do not sell your data or share it for marketing. A few companies process data on our behalf, each only for the one job named here:
- Contabo hosts the servers the service runs on, in the European Union.
- Resend delivers the mail the service sends: address confirmations, invitations, password links and alerts.
- A language model provider — none is set up at present; one will be named here before any data is sent to it — receives data only from the organisations that have switched on "Send this organisation's data to the AI provider" (Settings → AI). It is off for a new organisation, and the organisation's owner or admin can switch it on or off at any time. For those organisations it receives what a model is asked to read: for a ticket, by default the shape of the incident — names of hosts and services, kinds of operation, sanitised routes, status codes and the numbers — not log lines, error messages or anything a person typed, unless the service's administrator widens it to messages; what you ask the assistant and what the assistant looks up to answer you; a workflow's "Ask a model" step; and scan results with their values masked. For every other organisation nothing is sent, and its tickets keep the explanation the detectors wrote. By default the model only writes and suggests; the two modes in which a model decides something — the AI filter and the AI's own tickets — are off for an organisation unless they are switched on for it. What a model writes can be wrong; it is marked as the model's.
- Google sees only that you signed in to Obscenter with it, because the sign-in happens on its pages.
The service itself runs in the European Union. Resend, Google and the language model provider may process data outside it; such a transfer is made only with the safeguards of chapter V of the GDPR — an adequacy decision, or the European Commission’s standard contractual clauses in that company’s data processing terms. Ask us for the details of any of them.
How long
As long as you have an account. Invitations expire after seven days; password links after 60 minutes, and their records are deleted after 30 days; sign-in records after 180 days.
Deleting your data
Write to info@obscenter.site from the address of your account and ask for the account — or the whole organisation, if you own it — to be deleted. We do it within 30 days and confirm by email. This also removes what we received from Google. To stop Google from signing you in, you can also remove Obscenter from the apps connected to your Google account.
What your organisation measures
What the tag, the mobile agent and the server agent of an organisation send — about its visitors, users and machines — belongs to that organisation. It decides what is collected and why, and we store and process it only on its behalf and only to provide the service. If a site or app measured with Obscenter holds data about you, ask the people who run that site or app.
By default a visitor’s network address is kept only as a country and a salted hash. One exception is made for the organisation’s security: when a source is classified as guessing passwords at the sign-in page of one of the organisation’s services, its address is kept with the finding, together with its country, region and reverse DNS name, so that the organisation can see and block it. It is kept for 30 days after that source’s last attempt and is used for nothing else. For this check, the address of a request to a sign-in page is held in memory for up to half an hour; unless the source is classified this way, it is not stored.
A successful SSH login to an organisation’s machine is kept with its address, country, region and reverse DNS name, so that the organisation’s people can recognise their own logins and be told about one from a new place. These records are kept for 180 days.
Your rights
You can ask for a copy of what we hold about you, for it to be corrected or deleted, for its processing to be limited, for the data you gave us in a portable format, or object to it; write to info@obscenter.site. You can also complain to your data protection supervisory authority — in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, 1055 Budapest, Falk Miksa utca 9–11., naih.hu). No decision that affects you is made solely by automated means.
Email updates
Who
the operator of Obscenter (obscenter.site) is responsible for the addresses given in the “Stay in touch” form. Contact: info@obscenter.site.
What we keep
The email address you enter and the date and time you signed up. Nothing else: no name, no IP address, no cookie. To stop abuse, sign-up attempts are counted per network address for a few minutes, in memory only — that address is not stored.
Why
Only to send you occasional news about Obscenter, on the basis of your consent, which you can withdraw at any time.
Sharing
We do not sell your address or share it for marketing. The mail is delivered for us by Resend.
How long
Until you unsubscribe or ask us to delete it.
Your rights
Write to info@obscenter.site to unsubscribe, to have your address deleted, to correct it, or to ask what we hold about you. You can also complain to your data protection supervisory authority.
← Back to obscenter.site · Terms of service · Privacy notice · Open source licenses