Privacy Policy

1. Who is responsible for your data

LARSENQ AS (org.nr 930 284 815), a company registered in Norway, is the data controller for the personal data described in this policy. If you have any questions or want to exercise your rights, contact us at privacy@cmdv.to.

2. What we collect

• Account data. Your email address, used for passwordless sign-in and account-related communication. You do not need an account to use the app; you can create one if you want.
• Authentication and session data.One-time login codes (stored only as a short-lived hash), session tokens, a device label derived from your browser/user agent, and sign-in timestamps. This lets you stay signed in and manage your active sessions.
• Technical and security data.Limited technical information such as IP address and request metadata, processed to deliver the service, prevent abuse, and apply rate limits.

3. Cookies

We use only essential cookies required for authentication and security (for example, your session and anti-forgery tokens). We do not use analytics, advertising, or third-party tracking cookies.

4. How we use your data

We use your data to operate and secure the service: to authenticate you, keep you signed in, let you manage sessions, and protect the service against abuse.

5. Legal bases (GDPR)

For users in the EU/EEA, we rely on the following legal bases under the GDPR:

• Performance of a contract — to provide the account features you sign up for.
• Legitimate interests — to keep the service secure and prevent abuse, balanced against your rights.
• Consent — where you explicitly agree, such as accepting these terms when you sign up. You can withdraw consent at any time.

6. Where your data is processed and who processes it

We host cmdv in the European Economic Area and work only with providers that help us run the service, under appropriate data-processing terms. We do not sell your personal data.

• Scaleway (France, EEA) — hosts our backend and database, where your account data is stored.
• Scaleway Transactional Email (France, EEA)— sends your one-time login codes and account emails.
• Cloudflare — delivers our website and may process technical data such as IP address and request logs for delivery and security.
• mailbox.org (Germany, EEA)— provides our contact mailbox for support and privacy requests, so it processes any personal data you include when you email us.

7. International transfers

We keep processing within the EEA wherever possible. Some providers operate global networks, so limited technical data may be processed outside the EEA. Where that happens, the transfer is covered by an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses.

8. Data retention

We keep your account data for as long as your account exists. When you delete your account or ask us to delete your data, we remove your account data from our live systems within 30 days. Residual copies in our encrypted backups are deleted as those backups age out of our normal rotation, within roughly 30 days, after which they are not restored. We retain limited information only where required to meet legal obligations.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your data, to data portability, and to withdraw consent. To exercise any of these rights, contact us at privacy@cmdv.to. We currently handle account deletion on request and plan to add self-service deletion. We respond within the timeframes required by applicable law. If you are in the EEA and believe we have not handled your data properly, you may lodge a complaint with your supervisory authority; in Norway this is Datatilsynet (datatilsynet.no).

10. Security

We apply appropriate technical and organizational measures to protect the personal data we hold, and we collect as little of it as possible.

11. Children

cmdv is not directed to children under 16, and we do not knowingly collect their personal data.

12. Changes to this policy

We may update this policy from time to time, including our list of providers. We will update the date above and, for material changes, take reasonable steps to notify you.

13. Contact

Questions about your privacy or this policy? Email us at privacy@cmdv.to or reach out via our GitHub repository.