1. Controller
This policy describes how the fabricgate operator (the "Operator") handles personal data in the FPGA design registry "fabricgate" (the "Service").
2. Data we collect
| Category | Data | When |
|---|---|---|
| Account | Identity-provider identifier (issuer and subject; for GitHub sign-in, the numeric GitHub ID), username, email address | Sign-in (the email address is refreshed on every sign-in) |
| Audit log | Type of action, identifier of the actor, source IP address, target of the action; for administrative actions such as suspensions, the stated reason | Sign-in, publishing, namespace and membership changes, administrative actions |
| Download records | The design downloaded and, if signed in, the user's internal ID | Artifact downloads |
| API keys | The name you gave the key, its scopes and last-used time (the key itself is not stored, only a hash) | Creating and using API keys |
| Access records | Request path, response time and status. Application logs do not record IP addresses | Every request |
| Cookies | Session (fg_session, 24 hours), CSRF token, state during sign-in. Only cookies the Service needs to work; no analytics cookies or third-party trackers | Website sign-in |
Metadata of published designs (the author string written in the manifest, namespace names, usernames) is public as part of the Service.
3. Purposes
- Verifying identity and keeping you signed in
- Detecting and preventing abuse; rate limiting
- Keeping records of actions (security investigations, handling infringement notices)
- Statistics such as download counts (shown without identifying individuals)
- Contacting you (for example about a breach of the Terms)
4. Processors and transfers
The Service runs on the following providers, each of which processes personal data within its role. Auth0 data is stored in Japan (Tokyo region). The other providers are located outside Japan, and data is stored outside Japan (mainly in Singapore and the United States).
| Provider | Role | Data processed |
|---|---|---|
| Auth0 (Okta) | Authentication | Sign-in data, profile, sign-in history |
| Google Cloud | API server and logs (Cloud Run, Cloud Logging) | Request records (IP address, User-Agent); logs are kept for 30 days |
| Neon | Database | Data listed in Section 2 |
| Cloudflare R2 | Artifact storage and delivery | Download requests |
| Vercel | Website delivery | Request records (IP address, User-Agent) |
Personal data is not provided to any other third party except where required by law.
5. Retention
| Data | Period |
|---|---|
| Account, API keys, namespace memberships | While the account exists |
| Audit log | 90 days for ordinary actions, 1 year for significant actions such as suspensions and deletions; purged daily |
| User ID on download records | Removed after 90 days (the anonymous row is kept for counting) |
| Access records (logging platform) | 30 days |
| Database backups | Deleted rows remain for a while in restore history (restore window up to 7 days) and in the last 3 pre-release snapshots. If a restore is performed for disaster recovery, they may remain indefinitely in the branch that preserves the pre-restore state |
6. Your rights
- To delete your account, contact the address below. The account, its API keys and memberships are deleted.
- Audit log entries are security records and are kept until their retention period ends.
- Published designs are not deleted with the account; use the Service's own functions to withdraw a design.
- Requests for access, correction or suspension of use are handled at the same address.
7. Security
Connections are protected with TLS, API keys are stored only as hashes, and secrets are kept out of logs. Access is limited to the Operator, and actions are recorded in the audit log.
8. Changes
Changes to this policy are posted on this page. The history of changes is kept in the Service's source control.
9. Language
This policy is written in Japanese, and the Japanese text is the binding version. This English text is a reference translation.
10. Contact
Questions about personal data and deletion requests: abuse@fabricgate.dev
Last updated: 2026-10-14