1. Controller
Controller within the meaning of the GDPR: Aurelius Julian Ballweber, Alte Straße 2, 79541 Lörrach, Germany — contact at openadvisories.org. See the legal notice.
2. Hosting & infrastructure
This website runs on our own servers. We do not use external cloud services, content delivery networks, web fonts from third parties or embedded content. Your browser only talks to this server; no data is transferred to third parties such as Google, Meta or ad networks.
3. Server log files
When you open a page, the web server records technical information your browser sends: date and time, the requested URL, HTTP status, transferred bytes, referrer URL and browser identification (user agent). The IP address is shortened by the web server before it is written (the last part is removed), so a full IP address is never stored in the access log.
Purpose: operating the service securely, detecting abuse and fixing errors. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, working service). Logs are not combined with other data and are deleted automatically after 14 days.
4. Cookies & analytics
This site sets no cookies and uses no analytics, tracking pixels or fingerprinting. A strict Content Security Policy prevents any third-party script from loading.
5. Version check, lockfile scan & API
Package names and versions you enter in the version check are part of the page URL and therefore appear in the shortened server log like any other page request. Files and text submitted to the lockfile scan or /api/scan are processed in memory only to produce the result and are discarded immediately afterwards; they are neither stored nor logged. Lockfiles can contain internal package names — the scan never sends them anywhere.
6. Push notifications
If you turn on daily notifications, your browser creates an anonymous push address at its push service (Google for Chrome and Edge on Android, Mozilla for Firefox, Apple for Safari, Microsoft for Edge on Windows) together with two encryption keys. We store exactly that — the push address, the keys — plus the settings you chose (what to follow, minimum severity, delivery hour in UTC) and technical delivery dates. We do not store an e-mail address, your IP address, your time zone, device or browser details, and the record is not linked to any other data.
Notifications are encrypted end to end (RFC 8291): the push service delivers them but cannot read their content. It does learn that a message was delivered to the push address. Legal basis: Art. 6 (1) (a) GDPR — your consent, given by turning notifications on. You can withdraw it at any time with "Turn off" on the notifications page, which deletes the record immediately; blocking notifications in the browser makes the push address invalid, and we delete it on the next delivery attempt.
7. Contacting us
If you write to us by email, we store your message and address to handle your request and possible follow-up questions (Art. 6 (1) (b) and (f) GDPR). We do not pass them on without your consent and delete them once they are no longer needed, unless legal retention periods apply.
8. Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR), and the right to object to processing based on legitimate interest (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority. To exercise your rights, write to contact at openadvisories.org.
Last updated: 6 November 2026