1. Who we are
The Retro Commodore Archive (retro-commodore.eu) is a non-commercial digital preservation project dedicated to archiving scanned books, manuals, magazines, schematics, and other materials related to Commodore computers and the broader retro computing scene.
The data controller for this website is the site operator. You can reach us via the contact form.
2. What data we collect and why
Session cookies
We set a single session cookie to keep you logged in and to protect forms against cross-site request forgery (CSRF). This cookie is strictly necessary for the site to function and contains no personal information. It is deleted when you close your browser or log out.
Legal basis: legitimate interest (security) and, where applicable, your consent by using the site.
Page view statistics
We record which pages are visited, along with a one-way hash of your IP address (the raw address is not stored), your browser's user agent string, and the referring URL. This data is used solely to understand which parts of the archive are most useful.
Legal basis: legitimate interest in operating and improving the service.
Search logs
When you search the archive we log the search query, the number of results returned, your IP address, user agent, and referring URL. This helps us improve the search index and understand what materials users are looking for.
Legal basis: legitimate interest.
Download logs
Each file download is logged with the file identifier, your IP address, user agent, referring URL, and whether you were logged in at the time. This is used to prevent abuse, track download popularity, and maintain integrity of the archive.
Legal basis: legitimate interest.
Contact form
If you contact us via the contact form, we store your name, email address, message, and IP address. We use this information only to respond to your enquiry. We do not add you to any mailing list.
Legal basis: your consent by submitting the form.
User accounts
If you register for an account, we store your name, email address, and a securely hashed copy of your password (we never see your password in plain text). You may optionally provide a display name and upload a profile avatar. Registered users may also enable two-factor authentication, in which case an encrypted TOTP secret and recovery codes are stored.
Legal basis: performance of a contract (your account).
Sign in with Google
If you choose to sign in using your Google account, we receive your name, email address, and Google account identifier from Google. We store these to link your Google account to your archive account. We do not receive or store your Google password.
Legal basis: your explicit consent by initiating the Google sign-in flow.
3. Third-party services
Google OAuth — if you use Google sign-in, you are subject to Google's Privacy Policy.
Gravatar — profile pictures for registered users may be loaded from Gravatar (gravatar.com) using a hash of your email address. This only applies if you have not uploaded a custom avatar. Gravatar is operated by Automattic; see their privacy policy.
We do not use any advertising networks, social media trackers, or analytics platforms that share your data with third parties.
4. How long we keep your data
| Data | Retention |
|---|---|
| Session cookies | Until browser close or logout |
| Page view logs | Rolling 12 months |
| Search logs | Rolling 12 months |
| Download logs | Rolling 12 months |
| Contact messages | Until resolved, then deleted |
| User account data | Until account deletion is requested |
Note: the retention periods above reflect our intent. Automated deletion of aged log records is not yet implemented; data may be held for longer until pruning tooling is added.
5. Your rights
Under the GDPR (if you are in the EU/EEA) you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data ("right to be forgotten")
- Restriction — ask us to limit how we process your data
- Portability — receive your data in a machine-readable format (use the "Download your data" button in your profile)
- Objection — object to processing based on legitimate interest
- Withdraw consent — at any time, where processing is based on consent
To exercise any of these rights, please use the contact form. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
6. Cookies
We use only strictly necessary cookies. We do not use tracking, advertising, or analytics cookies.
| Cookie | Purpose | Duration |
|---|---|---|
retro_session | Maintains your login session and CSRF protection | Session / 2 hours |
XSRF-TOKEN | Cross-site request forgery protection | Session |
Because we only use strictly necessary cookies, we do not require a cookie consent banner under the ePrivacy Directive. If you use the "remember me" option at login, an additional long-lived cookie is set to keep you signed in across browser sessions.
7. Changes to this policy
We may update this policy from time to time. The "last updated" date shown at the top of this page reflects when it was last revised. Continued use of the site after changes constitutes acceptance of the updated policy.