Privacy
Telemetry opt-out
Citadel uses Plausible Cloud for product analytics — no cookies, no per-user fingerprint, DNT honoured for anonymous traffic. Signed-in users opt out at Settings → Privacy → toggle Telemetry off. Effect is immediate; no rebuild required.
Repo traffic metrics
Per-repo Traffic (Insights → Traffic) counts SSH git operations, HTTP git browse clients, and pack downloads over a rolling 14-day window. Counts are aggregate only: no per-visitor identity is stored or returned.
Anonymous HTTP browse requests that send DNT: 1 or Sec-GPC: 1 are excluded from the unique-visitor series. Signed-in browse is always counted. SSH views and clones are not gated on DNT/GPC.
What we collect
- Page views (path, referrer).
- Custom events for funnel stages, structured as category and event name; signed-in users with opt-out enabled do not generate these.
- No IPs are stored. No third-party trackers ride along.
Data export
Settings → Privacy → Export my data requests a portability bundle (JSON dumps of profile, repos metadata, audit log, support threads + raw avatar assets). The bundle is delivered by signed URL with a 14-day retention. Bare-repo bytes are not included — clone the repo for that.
Account deletion
Settings → Danger zone → Delete my account. The deletion enters a 7-day cooling window — visible as a banner across authed surfaces — during which you can cancel. After the window, the background runner revokes credentials, soft-deletes your namespace, and removes the underlying auth row.
Deletion cannot proceed while you own an active org — transfer or delete the org first. Owned bare repos under your namespace soft-delete with the namespace; on-disk hard-purge follows the standard go-cleanup window.
Audit log
Sensitive actions on your account (sign-ins, factor changes, OAuth grants, deletion request / cancel) are recorded in your account's audit log. You see recent rows on your dashboard's activity card.