Legal · GDPR

Privacy.

Last updated · 2026-05-31

What this site collects, in plain terms. Compliant with EU GDPR (Regulation 2016/679).

Who runs this site

Open VSX Pulse is an unofficial, non-commercial dashboard that aggregates public data from the Eclipse Open VSX Registry. It is built and operated by a single independent developer, tolbxela, as a personal project. It is not affiliated with the Eclipse Foundation.

Data controller contact: email.

What this site does not collect

  • No advertising cookies, no tracking pixels, no third-party advertising.
  • No user accounts, no profiling, no behavioural tracking across sites.
  • No browser fingerprinting.
  • Local theme preference is stored in your browser’s localStorage and never leaves your device.

Privacy-friendly analytics

Aggregate visit counts are collected by a self-hosted Umami instance at umami.tolbxela.com. Umami is cookieless and does not track individuals across sites. It records anonymous page views, referrer, country (derived from IP without storing the IP), browser, and OS. These metrics are visible only to the site operator.

Error reporting

Server-side errors are sent to a self-hosted GlitchTip instance at errors.tolbxela.com for diagnosis. Reports include the request path, stack trace, and the request’s IP and User-Agent. No request bodies, query strings with personal data, or session identifiers are included. Reports are retained for 30 days and then deleted.

Web server logs

The web server writes standard HTTP access logs for each request. These logs contain:

  • Source IP address
  • Request timestamp
  • HTTP method, path, status code, response size
  • User-Agent and Referer headers

Purpose: security, abuse prevention, and operational troubleshooting (detecting scrapers, mitigating denial-of-service attempts, diagnosing errors).

Legal basis (Art. 6(1)(f) GDPR — legitimate interest): operating a secure, reliable service. This interest has been weighed against your right to privacy: the data collected is the minimum required for security, is not used for analytics, marketing, profiling, or any other purpose, is never sold, and is never shared with third parties except where required by law.

Categories of data: IP address (considered personal data under GDPR), technical request metadata.

Recipients: only the site operator. No processors outside the EU/EEA receive these logs.

Retention: access logs are kept for a maximum of 14 days and then permanently deleted by automated log rotation. Logs related to a specific ongoing security incident may be retained longer for the duration of the investigation.

Automated decision-making: none. No profiling of visitors or automated decisions about you are made based on log data.

Data collected from Open VSX

The crawler queries the public Open VSX API hourly and stores extension metadata (names, descriptions, download counts, ratings, version history). This is public information published by extension authors and contains no personal data of site visitors.

Cookies

This site sets no cookies. None. The Umami analytics tracker is configured in cookieless mode.

Your rights under GDPR

If you are in the EU/EEA you have the right to:

  • Request access to any personal data held about you (Art. 15)
  • Request rectification (Art. 16) or erasure (Art. 17)
  • Object to processing based on legitimate interest (Art. 21)
  • Lodge a complaint with your national supervisory authority (Art. 77)

Since no personal data is held beyond transient server logs tied to IP addresses, most requests will result in confirmation that there is nothing to disclose. For erasure of IP logs, contact the site operator with the approximate timestamp and IP, and matching entries will be removed within 14 days (or sooner — they expire on their own).

Hosting & subprocessors

  • Application and database: self-hosted on infrastructure in the European Union.
  • Fonts: served by Google Fonts. Google may log requests as described in its privacy policy. If you prefer, block third-party requests in your browser — the site degrades gracefully to system fonts.
  • Charts: Apache ECharts served from jsDelivr CDN.

Changes

Material changes to this policy will be reflected in the “Last updated” date above.

← back to Open VSX Pulse