Legal

Privacy policy

What djust.org collects when you visit the site or join the community, why, who else processes it, and how to have it deleted.

Last updated: September 23, 2026

Who we are

djust.org is the website and community of the djust project (djust-org), the open-source Django LiveView framework. In this policy "we" means the djust project.

Questions about this policy, requests for your data, and requests to delete your account go to support@djust.org. Report security issues to security@djust.org.

The short version

  • We record every page view on our own server, including your IP address. We use this to understand our traffic.
  • Google Analytics only sets its cookies if you accept the cookie banner.
  • When something breaks, error reports go to our monitoring services, and they can include your IP address and, if you are signed in, who you are.
  • If you join the community, we keep the profile your GitHub or Google account shares with us, plus whatever you post. Posts and profiles are public.
  • We do not sell personal data and we do not use it for advertising.

Page views

Our server records each page you load (GET requests to pages; not images, stylesheets or other files). For each one we store:

  • the page address, the request method, the response status code and how long the response took;
  • your full IP address;
  • your browser's user agent string;
  • the referring page, if your browser sent one, and its domain;
  • any utm_source, utm_medium and utm_campaign values in the address;
  • whether the visit looks automated (a bot), and which rule decided that;
  • a random visitor ID from the djv cookie (see Cookies), so we can count unique and returning visitors;
  • the two-letter country your IP address belongs to. We look this up on our own server using the DB-IP Lite database; your IP address is not sent anywhere for this.

We use these records to see which pages people read, where they come from, and how fast the site is. Requests from well-known crawlers and command-line tools are not recorded at all.

After 90 days we anonymise these records: we remove the IP address, the visitor ID and the full referring address, and reduce the user agent to the browser and operating system family (for example "Chrome / macOS"). We keep the anonymous remainder (page, time, country, referring site, campaign tags) for long-term traffic statistics.

Google Analytics

We also use Google Analytics 4, in Google's consent mode. The first time you visit, a banner asks whether you accept analytics cookies.

  • Until you accept, analytics storage is set to "denied": Google Analytics does not set or read its cookies. The Google tag is still loaded from Google's servers, so Google receives your IP address and browser details as part of that request, and in this mode the tag can send Google measurement signals that carry no cookie identifier.
  • If you accept, Google Analytics sets its cookies and records your visits and some interactions (for example, clicks on the GitHub or Deploy links).
  • Your choice is saved in your browser's local storage under cookieConsent. To change it, clear this site's data in your browser; the banner will ask again.

Google processes this data under its own terms. See Google's privacy policy and how Google uses information from sites that use its services.

Error and performance monitoring

Sentry

In production, errors on the site are reported to Sentry. We have configured Sentry to include personal data in these reports, so a report can contain your IP address, details of the request that failed (the address, headers and submitted data) and, if you were signed in, your account's identity. Sentry also records performance traces and profiles for a sample of about 10% of requests. See Sentry's privacy policy.

djust Monitor

The site also reports to djust Monitor, our own monitoring service at monitor.djust.org. The djust project runs it on the same Hetzner servers as djust.org; it is not a third party. For every request it records the page address, method, status code, timings, your user agent, the referring page, the IP address the request came from and, if you are signed in, your account ID. When a request fails it also sends an error report with the request's address and headers (cookie, session and authorization values are removed first) and your account ID. Pages include a small script that reports JavaScript errors in your browser, with the page address and your user agent.

djust Monitor limits how long it keeps personal data:

  • Request records: after 30 days we remove the IP address, account ID and user agent. The page address, status code and timings are kept.
  • Error reports: 90 days after an error was last seen, we remove the request details, headers and user information. The error itself (its message and stack trace) is kept.
  • Logs: deleted after 90 days.

Community accounts

Signing in

You join the community by signing in with GitHub or Google. A small number of invited and moderator accounts sign in with a password instead. There is no open sign-up with a password.

What we get from GitHub or Google

When you sign in with GitHub or Google, we store:

  • your account ID with that provider;
  • the profile information the provider returns, which typically includes your name, username, email address and avatar image address;
  • your email address, on your djust.org account.

We do not store the provider's access tokens, so we cannot act on your GitHub or Google account after you have signed in. The site does not send you email.

Your profile

You can add a display name, headline, short bio, location, website, GitHub profile address, an uploaded avatar image, and choices for your snake avatar. Uploaded images are resized and re-encoded, which removes embedded metadata such as camera location.

What you post

  • topics and replies, and the earlier versions kept each time you edit one;
  • showcase projects: a tagline, demo and source links, tags and a cover screenshot;
  • reports you file about posts, with your reason;
  • the topics you follow and the notifications you receive.

To keep the community working we also store moderation records (actions taken on posts, with the moderator and reason), whether an account is trusted or suspended, and when you last posted, to enforce posting limits.

What is public

Published topics, replies, showcase projects, uploaded images and your profile are public: anyone can read them without signing in, and search engines can index them. Earlier versions of a post are visible to its author and to moderators. Reports are visible to moderators. Your public name is your display name or, if you have not set one, the username we created from the details GitHub or Google shared when you joined. Your email address is not shown on the site.

Theme votes

On /themes/ you can vote for themes.

  • If you are signed in, your vote is recorded against your account ID.
  • If you are not, your vote is recorded against a keyed hash (HMAC-SHA256) of your IP address, made with a secret key only our server holds. For IPv6 we hash the first 64 bits of the address. Your IP address itself is not stored with the vote.
  • To limit rapid voting, we keep a short-lived counter in our cache for about two minutes.

Cookies and local storage

  • djust_org_sessionid: keeps you signed in. Lasts up to two weeks.
  • djust_org_csrftoken: protects forms against cross-site request forgery. Lasts up to a year.
  • djv: the random visitor ID for our page-view records. It contains no personal details, cannot be read by scripts on the page, and lasts about two years.
  • Google Analytics cookies (names beginning _ga): only set if you accept the cookie banner.
  • cookieConsent in local storage: remembers your answer to the cookie banner.

Where your data is kept

The site runs on servers we operate at Hetzner. Our database (PostgreSQL) and cache (Redis) run on the same infrastructure. Uploaded images (avatars and showcase screenshots) are kept in S3-compatible object storage (MinIO) that we operate on the same Hetzner servers, and are served as public files from s3.djustlive.com.

Our database is backed up hourly to object storage at Hetzner in Germany, and backups are kept for 30 days. Data we delete or anonymise can remain in these backups until they expire.

The other services that process data for us are:

  • Google, for Google Analytics and for Google sign-in;
  • GitHub, for GitHub sign-in;
  • Sentry, for error reports.

Google, GitHub and Sentry may process data in the United States. Our Sentry project is hosted in Sentry's US region.

What we don't do

We do not sell personal data, and we do not use it for advertising.

Your choices and deleting your data

  • You can decline analytics cookies in the cookie banner, or block cookies in your browser. The site works without them; signing in needs the session cookie.
  • You can edit or remove your profile details at any time from your profile page.
  • You can ask for a copy of the personal data we hold about you, or for it to be corrected, by emailing support@djust.org.

There is no self-service account deletion yet. To delete your account, email support@djust.org from the address on your account, or tell us which GitHub or Google account you signed in with. We handle deletion requests within 30 days.

We delete your account and your profile, including your avatar. Your topics, replies and showcase projects are anonymised: they stay on the site, shown as written by "Deleted member", so the discussions they belong to stay readable. If you want specific posts removed as well, tell us which ones in your request and we will remove them. Removing a discussion you started also removes the replies in it.

Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top.