Privacy
Telemetry opt-out
Citadel uses Plausible Cloud for product analytics: no cookies, no per-user fingerprint, DNT honoured for anonymous traffic. Signed-in users opt out at Settings → Privacy → toggle Telemetry off. Effect is immediate; no rebuild required.
Repo traffic metrics
Per-repo Traffic (Insights → Traffic) counts SSH git operations, HTTP git browse clients, and pack downloads over a rolling 14-day window. Counts are aggregate only: no per-visitor identity is stored or returned.
Anonymous HTTP browse requests that send DNT: 1 or Sec-GPC: 1 are excluded from the unique-visitor series. Signed-in browse is always counted. SSH views and clones are not gated on DNT/GPC.
What we collect
- Page views (path, referrer).
- Custom events for funnel stages, structured as category and event name; signed-in users with opt-out enabled do not generate these.
- No IPs are stored. No third-party trackers ride along.
Data export
Settings → Privacy → Export my data requests a portability bundle (JSON dumps of profile, repos metadata, audit log, support threads + raw avatar assets). The bundle is delivered by signed URL with a 14-day retention. Bare-repo bytes are not included (clone the repo for that).
Account deletion
Settings → Danger zone → Delete my account. The deletion enters a 7-day cooling window (visible as a banner across authed surfaces) during which you can cancel. After the window, the background runner revokes credentials, soft-deletes your namespace, and removes the underlying auth row.
Deletion cannot proceed while you own an active org. Transfer or delete the org first. Owned bare repos under your namespace soft-delete with the namespace; on-disk hard-purge follows the standard go-cleanup window.
Audit log
Sensitive actions on your account (sign-ins, factor changes, OAuth grants, deletion request / cancel) are recorded in your account's audit log. You see recent rows on your dashboard's activity card.