RenewCMS/docs/privacy.md

Privacy and personal data

This page is for operators: whoever runs a RenewCMS instance is the data controller for it under the GDPR. It lists what the software stores about people, where, for how long, and what it sends elsewhere, so you can fill in your record of processing (art. 30), write your privacy notice (art. 13) and answer requests from the people concerned. It describes the software, not your obligations; it is not legal advice.

Who is concerned

• Back-office users: the owner and the admins they invite.
• Invitees who have not accepted yet.
• People named in content: authors, and anyone your editors write about or photograph.
• Anyone who performs an audited action (logging in, failing to log in, changing anything) has their IP address and browser recorded in the activity log.

Readers of your public site are not tracked by RenewCMS: the public routes set no cookie and log nothing in production.

What is stored, and for how long

Data	Where	Kept
Username, email, display name, role, bcrypt password hash	users table	Until the account is deleted (see Gaps).
Verification and password-reset codes	users table, bcrypt-hashed	Verification: until the account is verified. Reset: one hour, then useless; cleared when used.
Unverified sign-ups	users table	Deleted automatically 7 days after their verification code expired.
Invites: invitee email, hashed code, inviter	invites table	Deleted automatically 30 days after they expired or were accepted.
Sessions	The jwt cookie in the user's browser, valid 24 hours	Logging out revokes the session on the server; the revocation (a random id and an expiry, nothing else) is deleted once the session would have expired anyway.
API keys: name, prefix, SHA-256 hash, creator, last use	api_keys table	Until revoked. A revoked key stays listed.
Activity log: who (user id and name, API key name, or the username typed at a failed login), what, when, IP address, browser (user agent, truncated to 255 characters)	audit_events table	Settings → Activity: 30, 90 (default), 365 days or forever, and an optional size cap. Cleaned up once a night, at 03:00 server time.
Authors: name, slug, bio, avatar, website, social links; the linked user's email is shown to admins	authors table	Until deleted.
Articles and custom entries	articles, entries tables	Deleted articles are soft-deleted: the row and its content stay in the database (see Gaps).
Uploaded images	UPLOAD_DIR or the S3 bucket, plus the images table (file name, size, uploader)	Until deleted from the media library. Deleted images are soft-deleted in the table; the file itself is removed.

Photo metadata

Since this version, uploads are cleaned before they are stored. JPEG, PNG and WebP files lose their EXIF (GPS position, camera serial number, date), XMP, IPTC, comments and text chunks; only the orientation is kept, so rotated photos still display correctly. The pixels are not re-encoded. SVG files are stored as uploaded. Images uploaded with an earlier version are not cleaned retroactively: if they may carry GPS positions, download, clean and re-upload them, or merge them into a cleaned copy from the media library.

Activity log retention

For security logs, the CNIL generally recommends keeping access logs between six months and a year. The default of 90 days is shorter; choose 365 days in Settings if that suits your purpose. Avoid "Forever": it keeps IP addresses indefinitely, which the storage-limitation principle rarely justifies.

Cookies and browser storage

• jwt: the session cookie. HttpOnly, SameSite=Lax, Secure in production, 24 hours. Strictly necessary for the back office, so it needs no consent (ePrivacy art. 5(3); in France, Loi Informatique et Libertés art. 82).
• localStorage on the user's device holds interface choices only: language (renewcms-language), page sizes, open or collapsed panels, dismissed hints and columns. sessionStorage holds unsaved article drafts until the tab closes. None of it is sent to the server or to anyone else, and it needs no consent either.

RenewCMS sets no analytics, advertising or third-party cookie, so no consent banner is needed for the back office. Your public site may need one if it adds trackers.

What leaves the server

Destination	When	What
Your SMTP provider (SMTP_HOST)	Sign-up, invite, password reset	Recipient address, the message (with a one-time link). STARTTLS or implicit TLS is required for any non-loopback host unless you set SMTP_ALLOW_INSECURE=true.
Your S3 provider, if STORAGE_DRIVER=s3	Every upload and image read	The image files.
UPDATE_FEED_URL (default https://git.floriansylvain.fr)	Only when the owner clicks "Check for updates" or downloads one	The server's IP address and a standard HTTP request. No account or content data.

The back office loads nothing from third parties: fonts, icons and scripts are served by RenewCMS itself, and the Content-Security-Policy forbids any other source. Pick EU-based SMTP and storage providers, or make sure transfer safeguards (art. 44 and following) cover them, and list them as processors.

Security measures you can cite (art. 32)

• Passwords are hashed with bcrypt (cost 12). One-time codes are random UUIDs, stored hashed, single-use and short-lived. API keys are 256-bit random values stored as SHA-256 hashes.
• Login, password-reset and invite routes are rate-limited per client IP; failed logins are recorded as security events.
• Sessions are revocable: logout ends one session, a password reset ends all of them and revokes the user's API keys.
• Cross-site writes are refused, cookies are SameSite=Lax, and a strict Content-Security-Policy, X-Frame-Options: DENY and HSTS (in production) are sent.
• The server refuses to start with a short or example JWT_SECRET.
• Release binaries are signed (ed25519) and checked before a browser update is installed.

Answering requests from the people concerned

• Access and portability (art. 15 and 20): there is no self-service export yet. The data of a user is their row in users, their author profile, their API keys and the activity events where they are the actor; an owner can export the activity log as CSV from the Activity page and filter it by person.
• Rectification (art. 16): users can change their display name and author profile themselves. Changing an email address currently needs a database edit.
• Erasure (art. 17): an unverified account can cancel its own registration. Deleting a verified user has no button yet; see Gaps.

Gaps

These are known and tracked; until they are fixed, handle them by hand.

• No way to delete a verified user or remove an admin from the interface.
• No self-service export or email change.
• Soft-deleted articles and images keep their rows indefinitely.
• The username typed at a failed login is stored as typed, so a password typed in the wrong field can end up in the activity log; clean such events by hand if it happens.
• Images uploaded before metadata stripping keep their metadata.