Windrose

Privacy Policy

Last updated: 19 July 2026

Privacy at a glance

This policy explains what happens to your personal data when you visit this website or use the Windrose service. Personal data is any information that can identify you personally. Windrose is designed as a cookieless, first-party analytics service that minimizes the personal data it processes.

Data controller

Taras Frank
Erthalstr. 7
63739 Aschaffenburg, Germany
Email: hello@windrose.sh

Hosting

This website and the Windrose service are hosted on servers operated by Hetzner Online GmbH (Germany). Data is processed to provide the service securely and in accordance with our contract.

Server logs

The hosting provider automatically collects and stores information sent by your browser in server logs: IP address, request time, and browser information (user-agent). This data is processed to operate the service securely and reliably. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in stable and secure operation).

GitHub sign-in (OAuth)

Windrose uses GitHub, Inc.'s OAuth sign-in for dashboard access. Your name, email address, and the OAuth credentials needed for sign-in are processed to create and identify your account. IP addresses and user-agent information may also be stored in the session context for technically necessary session management. The legal basis is Article 6(1)(b) GDPR (performance of a contract or steps taken before entering into a contract). GitHub, Inc.'s privacy policy also applies.

Waitlist and contact

When you join the waitlist, we store your email address, request status, source, and the times of your request and approval. Your email address may also be sent to the operator through a configured notification service, currently the Telegram Bot API, for internal notifications. When you contact us, we process the information you provide to handle your request. The legal basis is Article 6(1)(b) GDPR when preparing to establish a service relationship, and otherwise Article 6(1)(f) GDPR.

Cookies

Windrose web analytics is cookieless. The dashboard uses technically necessary session cookies for signed-in users. These cookies are used only for sign-in and session management (Article 6(1)(b) GDPR, Section 25(2) of Germany's Telecommunications Digital Services Data Protection Act, TDDDG).

Our own cookieless web analytics

We operate our own first-party, cookieless web analytics. There is no cross-site tracking and no personal profiles are created. A visitor's IP address is processed only transiently at collection time to derive a daily rotating, non-reversible visitor identifier (hash) and country. The IP address itself is neither stored nor logged by the analytics system.

We store the timestamp, page path, referrer domain, UTM campaign values, voluntarily triggered event names, optionally submitted numeric event values and currency codes, country, device class, browser class, and daily rotating pseudonymous visitor identifier. Full referrer URLs, other URL query parameters, and raw user-agent strings are not stored. Country lookup uses DB-IP's IP database locally; the IP address is not sent to third parties for this lookup. Analytics events are automatically deleted after 13 months. The legal basis for our own audience measurement is Article 6(1)(f) GDPR.

For server-side AI crawler capture, the integrating website may also submit the crawler's IP address. It is processed only transiently to check the claimed crawler identity against the IP ranges published by the relevant provider (verification result), and is neither stored nor logged. These are IP addresses of automated crawlers (data-center addresses), not visitor IP addresses.

Roles for customer websites

When a customer uses Windrose on their own website, the customer decides the purpose and legal basis of audience measurement and generally acts as controller under the GDPR. Windrose processes the submitted analytics data on the customer's behalf and acts as processor for that data. A Data Processing Agreement (DPA) under Article 28 GDPR must be in place before production use. Information and an adaptable privacy-notice template are available in the Privacy Kit.

MCP usage telemetry

For service security and improvement, we store the user identifier, called tool, affected domain, queried period, success status, error code, and duration of MCP calls. Query contents and analytics results are not stored as telemetry. This data is automatically deleted after 90 days. The legal basis is Article 6(1)(f) GDPR.

To connect an MCP client, Windrose processes registered client data, consent decisions, and time-limited access and refresh tokens. The tokens have technical expiry times; associated records may remain stored beyond those times until revocation, manual account deletion, or operational data cleanup. A binding maximum retention period will be set before the public product launch.

Recipients and processors

Production systems and databases are operated at Hetzner Online GmbH in Germany. DB-IP is used as a locally embedded database and does not receive IP addresses. GitHub is used for account sign-in; GitHub's privacy terms also apply. Telegram may be used for internal waitlist notifications. When paid plans are used, Stripe processes the account and payment data needed for billing and payment processing.

Customer-configured webhooks

Customers can instruct Windrose to send analytics findings to an HTTPS address they choose, such as GitHub, Slack, or their own system. The aggregated metrics and technical paths contained in a finding are sent to the recipient selected by the customer. The customer is responsible for selecting that recipient and assessing its data-protection implications.

Retention

Analytics events are automatically deleted after 13 months, and MCP usage telemetry after 90 days. We keep account, waitlist, support, and contract data for as long as needed for the relevant purpose or statutory retention requirements. You can request deletion of your account and associated site data by emailing hello@windrose.sh.

Your rights

You have the right to:

To exercise these rights, email hello@windrose.sh.