Privacy notice

Who is responsible

The operator of this deployment hasn't named who is responsible for the processing.

What Krini processes

• No tracking. Krini has no analytics and no advertising. Visitors get no cookies, apart from the display setting below and, once they start a login, the cookie that protects it.
• Your user info from the login provider: what it releases to Krini, such as your name, email address, identifier and group memberships. Krini shows your name and your email address or identifier while you're logged in, and doesn't store any of it on its server.
• Display settings that you choose, in your browser only: the color theme (local storage) and whether the sidebar is open (a cookie, see below).

Cookies

All cookies except the sidebar setting are strictly necessary for logging in and staying logged in. Krini's server reads them. Scripts on the page can also read token_expires_at and sidebar_state, which hold no data about you, but not the tokens. The page gets the access token from Krini, to send it to the services you use.

• authState-…: protects a login in progress (10 minutes, or until the login ends)
• access_token: your access token, which Krini passes to the services (until the token expires, usually an hour)
• id_token: the login provider's confirmation of your login (an hour)
• refresh_token: renews your access token while you stay logged in (up to 30 days; deleted when you log out)
• token_expires_at: when your access token needs to be renewed (up to 30 days; deleted when you log out)
• logout_marker: keeps you logged out, so that no open page renews the session (30 days after you log out, or until you log in again)
• sidebar_state: whether the sidebar is open, only if you change it (7 days)

What happens elsewhere

• The login provider processes your login and your account, including requests for access. Its own privacy notice applies.
• The services that run tasks and workflows are contacted by your browser directly once you select one, also without login, so they see your IP address and browser. Workflow services (WES) also get your access token and record your user identifier with each workflow, for ownership, accounting and audit. Task services (TES) are called without your token for now. Each service is listed with its organization, whose terms apply.
• A content delivery network (cdn.jsdelivr.net) serves a helper script of the code editor in the workflow form, so it sees your IP address and browser when you open the form.
• The service registry tells Krini which services exist. Krini's server reads it and checks the listed workflow services, both without any data about you.