[{"data":1,"prerenderedAt":646},["ShallowReactive",2],{"content-en-\u002Flegal\u002Fprivacy":3},{"id":4,"title":5,"author":6,"body":7,"date":6,"description":638,"extension":639,"meta":640,"navigation":641,"path":642,"robots":6,"seo":643,"stem":644,"tags":6,"__hash__":645},"content_en\u002Flegal\u002Fprivacy.md","Privacy policy",null,{"type":8,"value":9,"toc":614},"minimark",[10,14,27,33,38,41,108,116,120,123,152,159,170,174,179,190,207,210,217,231,238,242,249,266,273,277,280,284,297,301,320,324,330,334,360,364,367,387,390,394,397,401,404,464,470,474,481,498,505,509,512,542,545,549,552,556,562,565,609],[11,12,5],"h1",{"id":13},"privacy-policy",[15,16,19],"callout",{"color":17,"icon":18},"primary","i-heroicons-information-circle",[20,21,22,26],"p",{},[23,24,25],"strong",{},"Short version."," The xiboplayer software itself does not phone home, has no telemetry, and sends no data to us. This page covers the limited data we collect through the project website and our communications channels.",[20,28,29],{},[30,31,32],"em",{},"Effective date: 2026-04-15. Last updated: 2026-04-15.",[34,35,37],"h2",{"id":36},"who-we-are","Who we are",[20,39,40],{},"The xiboplayer open-source project (\"xiboplayer\", \"we\", \"us\") — AGPL-3.0-or-later licensed, based in Catalonia (European Union).",[42,43,44,57],"table",{},[45,46,47],"thead",{},[48,49,50,54],"tr",{},[51,52,53],"th",{},"Contact",[51,55,56],{},"Address",[58,59,60,72,82,96],"tbody",{},[48,61,62,66],{},[63,64,65],"td",{},"General \u002F privacy questions",[63,67,68],{},[69,70,71],"code",{},"hello@xiboplayer.org",[48,73,74,77],{},[63,75,76],{},"Security disclosures",[63,78,79],{},[69,80,81],{},"security@xiboplayer.org",[48,83,84,87],{},[63,85,86],{},"Source code",[63,88,89],{},[90,91,95],"a",{"href":92,"rel":93},"https:\u002F\u002Fgithub.com\u002Fxibo-players",[94],"nofollow","github.com\u002Fxibo-players",[48,97,98,101],{},[63,99,100],{},"Website",[63,102,103],{},[90,104,107],{"href":105,"rel":106},"https:\u002F\u002Fwww.xiboplayer.org",[94],"xiboplayer.org",[20,109,110,111,115],{},"PGP keys for both mailboxes are on the ",[90,112,114],{"href":113},"\u002Fsecurity","Security page",".",[34,117,119],{"id":118},"what-this-policy-covers","What this policy covers",[20,121,122],{},"This policy applies to:",[124,125,126,144,147],"ul",{},[127,128,129,130,132,133,136,137,136,140,143],"li",{},"The website at ",[69,131,107],{}," and its subdomains (",[69,134,135],{},"www",", ",[69,138,139],{},"dl",[69,141,142],{},"images",")",[127,145,146],{},"Direct correspondence with project maintainers (email)",[127,148,149,150,143],{},"Contributions and discussions on our GitHub organisation (",[69,151,95],{},[20,153,154,155,158],{},"This policy ",[23,156,157],{},"does not"," cover:",[124,160,161,164,167],{},[127,162,163],{},"The open-source xiboplayer player software once you've installed it. The player operates entirely between your device and your own digital signage CMS — no traffic flows to us, ever.",[127,165,166],{},"Third-party Xibo CMS instances (those have their own operators and policies).",[127,168,169],{},"Third-party services you choose to use alongside xiboplayer (the Xibo CMS, Cloudflare R2 if you self-host, etc).",[34,171,173],{"id":172},"what-we-collect-why-and-for-how-long","What we collect, why, and for how long",[175,176,178],"h3",{"id":177},"when-you-visit-the-website","When you visit the website",[20,180,181,182,185,186,189],{},"We use ",[23,183,184],{},"server logs"," for security and operational purposes. These are kept for ",[23,187,188],{},"30 days"," and contain:",[124,191,192,195,198,201,204],{},[127,193,194],{},"IP address (truncated after 24 hours)",[127,196,197],{},"User-Agent header",[127,199,200],{},"Requested URL",[127,202,203],{},"Response status + size",[127,205,206],{},"HTTP referrer",[20,208,209],{},"Logs are stored on our server in the European Union (Frankfurt). They are never sold, shared, or used for tracking across sites.",[20,211,212,213,216],{},"We do ",[23,214,215],{},"not"," use:",[124,218,219,222,225,228],{},[127,220,221],{},"Third-party analytics (no Google Analytics, no Facebook Pixel, no Hotjar)",[127,223,224],{},"Advertising trackers",[127,226,227],{},"Marketing cookies",[127,229,230],{},"Cross-site tracking of any kind",[20,232,233,234,237],{},"A first-party cookie is set only to remember your ",[23,235,236],{},"light\u002Fdark mode preference"," if you change it. No personal data, no tracking ID.",[175,239,241],{"id":240},"when-you-submit-the-demo-form","When you submit the demo form",[20,243,244,245,248],{},"If you fill in the demo-request form on ",[69,246,247],{},"\u002Fdemo"," we collect:",[124,250,251,254,257,260,263],{},[127,252,253],{},"Your name",[127,255,256],{},"Your email address",[127,258,259],{},"Your company name (optional)",[127,261,262],{},"Approximate display count (optional)",[127,264,265],{},"Your free-text message",[20,267,268,269,272],{},"We use this ",[23,270,271],{},"only"," to reply to your enquiry. We do not add you to any mailing list, do not share with third parties, and do not retain the data after the conversation has reached a natural end (typically deleted within 12 months of the last reply).",[175,274,276],{"id":275},"when-you-email-us-directly","When you email us directly",[20,278,279],{},"We retain email correspondence for as long as the project relationship is active. You can request deletion at any time.",[175,281,283],{"id":282},"when-you-participate-on-github","When you participate on GitHub",[20,285,286,287,290,291,296],{},"GitHub Issues, Discussions, and Pull Requests on ",[69,288,289],{},"github.com\u002Fxibo-players\u002F*"," are public, and your participation there is governed by ",[90,292,295],{"href":293,"rel":294},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fsite-policy\u002Fprivacy-policies\u002Fgithub-general-privacy-statement",[94],"GitHub's privacy policy",". We do not capture additional data beyond what GitHub displays publicly.",[175,298,300],{"id":299},"when-you-download-a-package","When you download a package",[20,302,303,304,307,308,313,314,319],{},"Package downloads from ",[69,305,306],{},"dl.xiboplayer.org"," produce server log entries (see \"When you visit the website\" above). The download itself happens over a CDN (",[90,309,312],{"href":310,"rel":311},"https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fr2\u002F",[94],"Cloudflare R2"," — see ",[90,315,318],{"href":316,"rel":317},"https:\u002F\u002Fwww.cloudflare.com\u002Fcloudflare-customer-dpa\u002F",[94],"Cloudflare's data processing addendum",").",[175,321,323],{"id":322},"vulnerability-reports","Vulnerability reports",[20,325,326,327,329],{},"If you submit a vulnerability report to ",[69,328,81],{},", we keep the correspondence indefinitely as part of our security record. You can request that personal identifiers be redacted from public advisories.",[34,331,333],{"id":332},"legal-basis-gdpr-art-6","Legal basis (GDPR Art. 6)",[124,335,336,342,348,354],{},[127,337,338,341],{},[23,339,340],{},"Server logs",": legitimate interest in operating and securing the website (Art. 6(1)(f))",[127,343,344,347],{},[23,345,346],{},"Demo form",": pre-contractual measures at your request (Art. 6(1)(b))",[127,349,350,353],{},[23,351,352],{},"Email correspondence",": legitimate interest + consent (Art. 6(1)(a)\u002F(f))",[127,355,356,359],{},[23,357,358],{},"GitHub interactions",": governed by your GitHub account, GitHub is the controller for that platform",[34,361,363],{"id":362},"data-sharing","Data sharing",[20,365,366],{},"We do not sell, rent, or trade your personal data. We share it only with:",[124,368,369,375,381],{},[127,370,371,374],{},[23,372,373],{},"Our hosting provider"," — Hetzner (Germany, Frankfurt) for the website + email",[127,376,377,380],{},[23,378,379],{},"Cloudflare"," — CDN for downloads and DNS, processor under our DPA",[127,382,383,386],{},[23,384,385],{},"GitHub"," — when you interact via GitHub (you've already consented to GitHub's terms)",[20,388,389],{},"That is the complete list.",[34,391,393],{"id":392},"international-transfers","International transfers",[20,395,396],{},"We host in the European Union by default (Frankfurt primary, Madrid secondary). The CDN (Cloudflare) and GitHub may process data in other jurisdictions including the United States. We rely on EU Standard Contractual Clauses + the EU-US Data Privacy Framework adequacy decision for those transfers.",[34,398,400],{"id":399},"your-rights-under-gdpr","Your rights under GDPR",[20,402,403],{},"You can:",[124,405,406,412,418,424,434,440,446],{},[127,407,408,411],{},[23,409,410],{},"Access"," the data we hold about you",[127,413,414,417],{},[23,415,416],{},"Rectify"," inaccurate data",[127,419,420,423],{},[23,421,422],{},"Erase"," your data (\"right to be forgotten\")",[127,425,426,429,430,433],{},[23,427,428],{},"Restrict"," or ",[23,431,432],{},"object to"," processing",[127,435,436,439],{},[23,437,438],{},"Port"," your data to another provider",[127,441,442,445],{},[23,443,444],{},"Withdraw consent"," at any time",[127,447,448,451,452,457,458,463],{},[23,449,450],{},"Complain"," to a competent data protection authority — for project-related processing in Catalonia, you can address ",[90,453,456],{"href":454,"rel":455},"https:\u002F\u002Fapdcat.gencat.cat\u002F",[94],"APDCAT"," for matters within its competence, or ",[90,459,462],{"href":460,"rel":461},"https:\u002F\u002Fwww.aepd.es\u002F",[94],"AEPD"," for matters under its competence; or to your own national data protection authority if you reside elsewhere in the EU",[20,465,466,467,469],{},"To exercise any of these rights, email ",[69,468,71],{},". We will respond within 30 days.",[34,471,473],{"id":472},"data-we-dont-have","Data we don't have",[20,475,476,477,480],{},"Because of how the project is built, there are categories of data we ",[23,478,479],{},"structurally cannot collect"," even if asked:",[124,482,483,486,489,492,495],{},[127,484,485],{},"Which CMS your xiboplayer installation talks to",[127,487,488],{},"What content your displays show",[127,490,491],{},"How many displays you operate",[127,493,494],{},"When your displays come online or go offline",[127,496,497],{},"Anything about end users who watch your displays",[20,499,500,501,504],{},"The player communicates only with the CMS ",[30,502,503],{},"you"," configure. We never see that traffic.",[34,506,508],{"id":507},"cookies","Cookies",[20,510,511],{},"We set one first-party cookie:",[42,513,514,527],{},[45,515,516],{},[48,517,518,521,524],{},[51,519,520],{},"Cookie",[51,522,523],{},"Purpose",[51,525,526],{},"Lifetime",[58,528,529],{},[48,530,531,536,539],{},[63,532,533],{},[69,534,535],{},"xp-color-mode",[63,537,538],{},"Remember your light\u002Fdark mode choice",[63,540,541],{},"1 year",[20,543,544],{},"That's it. No analytics cookies, no advertising cookies, no third-party cookies set by our site.",[34,546,548],{"id":547},"children","Children",[20,550,551],{},"The project is not directed at children under 16. We do not knowingly collect personal data from children.",[34,553,555],{"id":554},"changes-to-this-policy","Changes to this policy",[20,557,558,559,561],{},"If we make material changes, we will update the \"Last updated\" date at the top of this page and announce significant changes via the project blog and ",[69,560,71],{},". The previous version is preserved in the project's git history for transparency.",[34,563,53],{"id":564},"contact",[42,566,567,575],{},[45,568,569],{},[48,570,571,573],{},[51,572,523],{},[51,574,56],{},[58,576,577,586,597],{},[48,578,579,582],{},[63,580,581],{},"Privacy questions \u002F data-subject requests",[63,583,584],{},[69,585,71],{},[48,587,588,590],{},[63,589,76],{},[63,591,592,594,595,143],{},[69,593,81],{}," (see ",[90,596,114],{"href":113},[48,598,599,602],{},[63,600,601],{},"General contact",[63,603,604],{},[90,605,608],{"href":606,"rel":607},"https:\u002F\u002Fgithub.com\u002Fxibo-players\u002Fxiboplayer\u002Fdiscussions",[94],"GitHub Discussions",[20,610,611,612,115],{},"PGP keys for both addresses are listed on the ",[90,613,114],{"href":113},{"title":615,"searchDepth":616,"depth":616,"links":617},"",3,[618,620,621,629,630,631,632,633,634,635,636,637],{"id":36,"depth":619,"text":37},2,{"id":118,"depth":619,"text":119},{"id":172,"depth":619,"text":173,"children":622},[623,624,625,626,627,628],{"id":177,"depth":616,"text":178},{"id":240,"depth":616,"text":241},{"id":275,"depth":616,"text":276},{"id":282,"depth":616,"text":283},{"id":299,"depth":616,"text":300},{"id":322,"depth":616,"text":323},{"id":332,"depth":619,"text":333},{"id":362,"depth":619,"text":363},{"id":392,"depth":619,"text":393},{"id":399,"depth":619,"text":400},{"id":472,"depth":619,"text":473},{"id":507,"depth":619,"text":508},{"id":547,"depth":619,"text":548},{"id":554,"depth":619,"text":555},{"id":564,"depth":619,"text":53},"What personal data the xiboplayer open-source project collects, how we handle it, and your rights under GDPR. Plain language, no dark patterns.","md",{},true,"\u002Flegal\u002Fprivacy",{"title":5,"description":638},"legal\u002Fprivacy","3jlAEI0yD7LqhoT7rgHBgic70Qas5e9fMKdIeAEOHmg",1777112059786]