Privacy notice
Last updated: 10 October 2026
This notice explains what personal data the Pinscope service handles, why, for how long, and what you can do about it.
1. Who is responsible
FluxCore Labs, a company based in Serbia, operates Pinscope and is the controller of the account data described here. For anything about your data, write to office@fluxcorelabs.io.
For what your devices send to the service (logs, metrics, crash reports, firmware), you decide what is collected and why. We store and process it on your behalf, as your processor, and only to provide the service. If your devices handle personal data of other people and you need a data processing agreement, ask us for one.
2. What we store, why and for how long
| Data | Why | How long |
|---|---|---|
| Email address; password as a salted hash | To sign you in and send account and alert emails | Until you delete the account |
| Sign-in sessions | To keep you signed in | 30 days |
| Email confirmation and password reset links | To prove an address is yours | Three days; one hour |
| Projects, API token hashes, alert settings, request rules | To run the features you set up | Until you delete them |
| Devices: hardware ID, name, chip, firmware version, last network address | To show and manage your devices | Until you delete the device |
| Logs and metrics from your devices | To show them to you | 7 to 90 days, depending on your plan |
| Crash reports and restart history | To show them to you | 90 days |
| Firmware images and ELF files you upload | To update your devices and decode their crashes | Until you delete them |
| Tunnel traffic volume per device and month | To apply plan limits | About 13 months |
| Backups of all of the above | To recover from a failure | 7 days |
We do not look at the content that passes through the tunnel between you and your devices, and we do not store it. We do not use your data for advertising or to build profiles, and no decisions about you are made by automated means.
3. Legal basis
- Providing the service you signed up for (a contract with you): your account, your devices and everything they report.
- Our legitimate interest in keeping the service secure and fairly used: sign-in attempt limits, traffic volume, backups.
- Legal obligations: records we must keep once paid plans are billed.
4. Cookies and browser storage
The dashboard sets one cookie to keep you signed in. Opening a device's address sets one cookie that remembers you are allowed to open it. Your light or dark theme choice is kept in your browser. There are no advertising or analytics cookies, so there is nothing to consent to.
5. Who else handles the data
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of the server and its backups | Finland (EU) |
| Resend | Sending account and alert emails; it receives your email address and the message | EU region; the company is based in the United States |
| Let's Encrypt (ISRG) | TLS certificates for device addresses; it receives only the host name, which becomes public in certificate transparency logs | United States |
Where data reaches a provider outside the European Economic Area, it does so under that provider's standard contractual safeguards. We do not sell personal data and do not share it with anyone else, unless a law requires us to.
6. Security
Connections use TLS. Passwords are stored as salted hashes; API tokens and device credentials as hashes. Logs, crash reports and uploaded firmware are encrypted on disk with a key kept apart from the database. No system is perfectly secure; if we learn of a breach that affects you we will tell you without undue delay.
7. Your rights
In the dashboard you can change your password, delete devices, logs, firmware and projects, see what your account uses, and delete the account itself. You can also ask us to:
- give you a copy of your personal data;
- correct it;
- restrict or stop a particular use of it.
Write to office@fluxcorelabs.io and we answer within 30 days. You may also complain to the data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the European Union, the authority of the country where you live.
8. Children
The service is meant for people who build and operate devices professionally or as a hobby. It is not directed at children under 16.
9. Changes
If this notice changes in a way that matters, we tell account holders by email before the change applies. The current version is always on this page.