Privacy Policy

1. Responsible party

The party responsible for processing your data (responsable del tratamiento under Ley 1581 de 2012) is UniverLab, an independent laboratory run from Colombia.

To exercise any right in this policy, write to [email protected]. That address reaches the lab directly.

2. What we collect, per service

Each service below collects only what it needs to work. Nothing we collect is used for advertising or marketing or to train models, and nothing is sold.

univerlab.org and the announcements feed. No accounts, no sign-in, no tracking cookies. Reading pages or the feed leaves no profile of you. Like every site, requests pass through the host infrastructure, so Cloudflare keeps its own request logs of the connections it serves.

The site’s public content (its texts, documentation and logbook, never personal data) is offered to search engines and AI systems, training included, through the content signal in robots.txt (Content-Signal: search=yes, ai-input=yes, ai-train=yes).

graphs.univerlab.org. The catalogue shows only public repositories that carry the canopy-graph topic: the owner login, the repository name, its description, stars, last update date, and the published graph and node documents with their READMEs.

It reads that data from GitHub and keeps temporary copies at Cloudflare only to serve the catalogue. A document or repository removed from GitHub, or stripped of the topic, leaves the catalogue within 30 minutes.

Install counts record the document, a client class (canopy CLI, browser or other), the canopy version, the country Cloudflare derives, and the outcome. They hold no IP address, no full user-agent and no cookie. Counts are stored by Cloudflare Analytics Engine and shown as 90-day totals.

remote.univerlab.org. Signing in with GitHub stores your GitHub numeric id and login in a signed session cookie that expires after 12 hours. The GitHub sign-in token is discarded at once. The relay stores nothing and only forwards the signalling that connects a browser to its owner’s canopy host. Sessions travel peer to peer, encrypted end to end (WebRTC DTLS), with Cloudflare TURN relaying ciphertext when a direct path fails. Device keys stay in the browser and on the host.

quorum.univerlab.org. Peer-to-peer planning poker: no accounts, no cookies and no analytics. Your display name, theme and each room’s stories stay in your browser. To let the browsers of a room find each other, Quorum uses public WebTorrent trackers run by third parties: they see your IP address and an identifier derived from the room, never your votes. After that, data travels straight between browsers over WebRTC, so the people in your room see your name, your votes and your IP address. UniverLab receives none of it: it only serves the app’s files from Cloudflare.

canopy CLI and daemon. Your data stays local in ~/.canopy on your own machine. UniverLab services are contacted only when you use them: fetching a graph from the catalogue, or pairing through the relay. Agent harnesses (Claude, Codex and the rest) are governed by their own providers’ terms.

Reports. Bug reports and catalogue reports are GitHub issues in public repositories: whatever you write there is public under GitHub’s terms.

3. Purposes

One line per service:

• univerlab.org and the feed: publishing the lab’s pages and logbook.
• graphs.univerlab.org: serving a catalogue of public community graphs and counting installs in aggregate.
• remote.univerlab.org: keeping you signed in for 12 hours so your browser can reach your own canopy host.
• quorum.univerlab.org: serving the app; each room is held up by its participants’ own browsers.
• canopy CLI and daemon: running your graphs on your machine; contacting UniverLab services only for the fetch or pairing you asked for.

4. Legal bases

Under Ley 1581 de 2012, we process your data on these bases. For readers under the GDPR, the equivalent basis follows in brackets.

The sign-in is your authorisation (autorización): signing in with GitHub authorises the 12-hour session cookie [GDPR: consent].

Catalogue data is data of a public nature published by its author (Ley 1581, article 10): public repositories its owners chose to tag, processed for the catalogue only [GDPR: legitimate interest in running a public catalogue of public data].

The install counter is the lab’s legitimate interest in aggregate, non-identifying statistics about which documents get installed [GDPR: legitimate interest].

5. Processors and international transfer

Two providers process data on our behalf, both in the United States, so your data leaves Colombia when you use the services (the public WebTorrent trackers Quorum uses are not our processors: independent third parties run them, and they only introduce the browsers of a room to each other):

• Cloudflare: hosting, caching, Analytics Engine install counts and TURN relaying.
• GitHub: sign-in identity and the public source data the catalogue reads.

Cloudflare privacy statement · GitHub privacy statement

6. Retention

How long each figure above lasts:

• univerlab.org: no accounts and no tracking cookies, so nothing of yours is retained; Cloudflare keeps its own request logs under its policy.
• Catalogue copies: temporary, refreshed from GitHub; removals leave the catalogue within 30 minutes.
• Install counts: 90-day totals, with no IP address, no full user-agent and no cookie behind them.
• Quorum: your name, theme and stories stay in your browser until you clear them; UniverLab keeps nothing.
• Remote session cookie: 12 hours, then it expires; the sign-in token is discarded at once and the relay stores nothing.
• canopy CLI and daemon: your data stays in ~/.canopy until you remove it.

7. Your rights

As a data subject (titular) you hold the rights of Ley 1581, article 8: to know, update and rectify your data; to request proof of your authorisation; to be informed of how your data is used; to revoke your authorisation and request deletion; and to complain to the Superintendencia de Industria y Comercio (SIC). Access is free.

Under the GDPR you equivalently hold access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time.

8. How to exercise them

Write to [email protected]. Queries (consultas) are answered within 10 business days, extendable once by 5; claims (reclamos) within 15 business days, extendable once by 8 (Ley 1581, articles 14 and 15).

Catalogue data has a shorter path too: the author removes a document by dropping the canopy-graph topic or the repository, or anyone may report a document by opening an issue in UniverLab/canopy-web.

9. Security, children, changes

Security. The services rely on Cloudflare and GitHub safeguards, the signed session cookie and end-to-end encrypted relay sessions. No internet service can guarantee security, and you should not send sensitive data through reports or issues, which are public.

Children. The services ask no one their age and do not knowingly collect data from minors. If you believe a minor left data with us, write to us and we will delete it.

Changes. This policy changes by dated revision: the date above moves and the effective date moves with it.