Create AccountLogin

Privacy Policy

Last updated: Sun 25. Oct

This policy covers CNS Accounts: the account website at accounts.cns.ad, the account and sign-in service at api.cns.ad that other CNS Studios services use, and the CNS Accounts app for Android. Services you sign in to with your account (for example Sendly) have their own privacy policies for what they do with your data.

1. Who is responsible

The controller under Art. 4(7) GDPR is:

Aaron Gerkens, operating as a part of CNS Studios (not a registered company), Mittelstraße 79, 22869 Schenefeld, Germany. Email: [email protected]

In this policy 'we' means the team behind CNS Studios that runs CNS Accounts. We have not appointed a data protection officer because we are not required to (Art. 37 GDPR, § 38 BDSG).

2. The short version

  • We store your username, a hash of your password, your profile (display name, profile picture) and security data such as your sessions, devices and an activity log with IP addresses.
  • We need your email address only to send you a verification code when you sign up. We do not store it in your account.
  • When you sign in to another CNS Studios service with your account, that service receives your user ID, username and profile.
  • We use no advertising, no analytics and no tracking cookies. The cookies we set keep you signed in.
  • CNS Accounts runs on our own servers in Germany. All traffic goes through Cloudflare as the edge in front of them. Emails are sent through Resend, app notifications through Google Firebase.

3. What we process, why, and on what legal basis

3.1 Visiting the website and using the API

When you open a page or an app talks to our API, the request passes through Cloudflare (section 3.10) to our servers. Both process your IP address, the time of the request, the requested path, the HTTP status, the response time and technical data your browser or app sends (such as the user agent). We need this to deliver the service, keep it secure and find errors.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating and securing the service). Retention: see section 7.

3.2 Creating an account

When you sign up we process:

  • your username and password
  • your email address
  • your confirmation that you accept the Terms of Service

We send a six-digit verification code to your email address. Until you enter it, your username, email address, a hash of your password and the code are held in a short-lived memory store for at most 5 minutes. Once your account is created (or the 5 minutes pass), the email address is discarded. It is not stored in your account.

We never store your password, only an Argon2id hash of it. To keep you from using a password that is known from data breaches, we check it against the Have I Been Pwned database using a method called k-anonymity: only the first 5 characters of the password's SHA-1 hash are sent to the Have I Been Pwned service, never the password or the full hash, so the password cannot be determined from what is sent. The same check runs when you change your password.

Legal basis: Art. 6(1)(b) GDPR (creating the account you ask for); for the breach check, Art. 6(1)(f) GDPR (protecting your account and our service).

3.3 Your account and profile

For each account we store:

  • user ID, username, display name and level
  • profile picture, if you upload one
  • date of registration and of the last change
  • time and IP address of your last sign-in
  • number of failed sign-in attempts and, if your account was locked, until when
  • whether your account is active, locked or deleted

Profile pictures are stored with an object storage provider (section 5) and are served from a public address that anyone who has it can open. They are shown to other users in services that display profiles, such as Sendly.

Legal basis: Art. 6(1)(b) GDPR.

3.4 Signing in, sessions and devices

When you sign in we process:

  • a session for each signed-in browser or app: creation time, last activity, expiry, the IP addresses used and the user agent (browser, operating system or app)
  • sign-in tokens: short-lived access tokens (15 minutes) and refresh tokens. We store only a hash of each refresh token, together with its IP address, user agent, and issue and expiry time
  • if you use two-factor authentication: the secret of your authenticator app, encrypted with AES-256-GCM, and the time you turned it on
  • if you set up a recovery phrase: only a keyed hash of the phrase and the time you created it, never the phrase itself. It is deleted once you use it
  • counters per IP address, username, and sign-in attempt in a short-lived memory store (Redis) to limit requests and stop password guessing. After 5 failed attempts in a row an account is locked for 5 minutes

You can see your sessions under Devices and sign out any of them. QR code sign-in: when a browser shows a sign-in QR code, we keep its IP address and user agent with the code for at most 2 minutes (plus 30 seconds to finish the sign-in), so that the app scanning it can show you which browser and system are asking to sign in.

Legal basis: Art. 6(1)(b) GDPR (signing you in); Art. 6(1)(f) GDPR and Art. 32 GDPR for security measures (rate limits, lockout).

3.5 Activity and security log

We record security-relevant events of your account, such as sign-ins and failed sign-ins, password or username changes, turning two-factor authentication on or off, signing out sessions, connecting or disconnecting apps, and deleting the account. Each entry contains the event type, time, IP address, user agent and details of the event. You can see these entries under Activity. Some internal entries (for example token renewals and background data syncs by apps) are stored but not shown there.

Certain events, such as the reuse of a sign-in token that was already replaced (a sign of a stolen token), create an alert for our administrators. These alerts contain your user ID and the event details and can be sent to them by email.

Legal basis: Art. 6(1)(f) GDPR (detecting and investigating misuse of accounts, showing you what happened on your account) and Art. 32 GDPR.

3.6 Signing in to other services (connected apps)

You can use your account to sign in to other services, for example Sendly, Verdant, Dropzone or the CNS Studios website. When you do, we record which service you signed in to, the permissions (scopes) granted, and when. You can see connected apps under Apps and disconnect them, which signs that service out.

The service receives your user ID, username and profile (display name and profile picture) and whether your account is active or locked. Each service can store a small amount of data linked to your account with us, which only that service can read. Sendly, for example, stores whether your Sendly profile is active and when it last synced. CNS Studios services can also ask us to send a notification to your CNS Accounts app (section 3.7); they send only the type of event and an ID, not its content.

All of these services are currently operated by us. If a service run by someone else is ever connected, we will name it here, and it will need your consent before it receives your data.

Legal basis: Art. 6(1)(b) GDPR (signing you in to the service you chose).

3.7 The CNS Accounts app

The app uses the same account data as the website. In addition:

  • Notifications: to send notifications (new sign-in, password changed, approval requests, and events from services such as Sendly), we store the app's Firebase Cloud Messaging token, the platform and your notification setting, linked to the app's session. Notifications are delivered through Google Firebase and contain only the type of event and an ID. The token is deleted when you sign out of the app.
  • Require Security App: if you turn this on, the app creates a key on your phone that never leaves it. We store its public part, a device name and the protection level of the key (for example whether it is held in secure hardware), which we check with the key attestation that Android provides. For each action that needs approval we store the action, its status and times, and the IP address and browser or system that requested it, so the app can show you what you are approving.
  • QR code sign-in: see section 3.4.

Legal basis: Art. 6(1)(b) GDPR.

3.8 Support and contact

If you open a support ticket on the Help & Support page or write to us, we process the ticket title, your username, your email address, the content of your message and any data you include, in order to answer you. Tickets are sent as an email to our support mailbox through Resend (section 5). We do not store them on our servers. Your IP address is used briefly to limit how many tickets can be sent.

Legal basis: Art. 6(1)(b) GDPR where your request concerns your account, otherwise Art. 6(1)(f) GDPR.

3.9 No tracking

We do not use advertising, analytics or profiling. Fonts are served from our own servers, so your browser does not contact font providers.

3.10 Cloudflare

All traffic to CNS Accounts, including the website, the API and the app, passes through the network of Cloudflare, Inc. (USA), which acts as the edge: a protective and delivery layer in front of our servers.

  • Cloudflare ends the encrypted connection (TLS) at its servers and forwards the traffic to ours. This means Cloudflare can technically see traffic in transit, including your IP address and what you enter, such as your password.
  • Cloudflare processes this data on our behalf under a data processing agreement (Art. 28 GDPR). It also provides basic traffic statistics. For its own security and network operation, Cloudflare processes some data as an independent controller. See Cloudflare's privacy policy for details.
  • Cloudflare may set technical cookies for security purposes (section 4).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, available service protected against attacks.

4. Cookies and local storage

CNS Accounts stores the following on your device:

  • cns_session: your current sign-in (access token), signed and not readable by scripts. Up to 30 days.
  • cns_auth_refresh: the token that renews your sign-in, not readable by scripts. It is shared with other CNS Studios services on cns.ad so that you stay signed in across them. 7 days.
  • sidebar_state: whether the dashboard sidebar is open. 7 days.
  • The CNS Accounts app keeps its sign-in tokens in the protected storage of your phone.

All of this is strictly necessary to provide the service you asked for or to remember a setting you made. Under § 25(2) no. 2 TDDDG no consent is needed, so there is no cookie banner. Cloudflare may set its own technical cookies for security.

5. Who receives your data

  • Cloudflare, Inc. (USA) as processor (CDN and proxy). It handles all traffic and request data such as IP addresses.
  • Hosting: CNS Accounts runs on our own servers in Germany, so no hosting company processes the data.
  • Cloudflare, Inc. (USA) also stores profile pictures for us (Cloudflare R2), as processor.
  • Resend, Inc. (USA) as processor, to send emails: verification emails (your email address, username and the code), support tickets (everything you enter in the ticket form) and security alerts to our administrators.
  • Google Ireland Ltd. / Google LLC (USA) (Firebase Cloud Messaging) as processor, to deliver notifications to the CNS Accounts app. It receives the app's notification token and the notification (event type and ID).
  • Have I Been Pwned (Superlative Security Pty Ltd, Australia) receives only the first 5 characters of your password's hash (section 3.2), which is not personal data.
  • CNS Studios services you sign in to, operated by us (section 3.6).
  • Other users see your username, display name and profile picture in services that show them.
  • Authorities: only if a valid legal order or legal obligation requires it.

We do not sell your data.

6. Transfers outside the EU/EEA

Cloudflare, Resend and Google process data in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision for certified companies and, additionally, on standard contractual clauses (Art. 46 GDPR). You can request a copy of the safeguards from us.

7. How long we keep data

  • Account and profile data: while your account exists. When you delete your account, it is deactivated immediately and all sessions are signed out. The deactivated account record (username, profile and the data below that belongs to it) currently remains stored, and your username stays reserved so nobody can pose as you. If you want it erased completely, write to [email protected] and we will erase it within one month.
  • Pending sign-ups (including your email address): at most 5 minutes.
  • Sessions and sign-in tokens: access tokens expire after 15 minutes, refresh tokens after 30 days. Records of ended or expired sessions and tokens are kept with your account (see above), so you can see past sign-ins.
  • Activity and security log (including IP addresses): kept with your account (see above).
  • Admin alerts: kept with your account (see above).
  • Approval requests and QR codes: QR codes at most 2½ minutes; approval requests 30 days.
  • Notification tokens: until you sign out of the app or the session ends.
  • Rate limit counters: at most 15 minutes.
  • Server logs: until the service is next redeployed, when they are replaced.
  • Backups of the database: daily backups for 7 days, weekly backups for 4 weeks. Data you deleted can therefore remain in a backup for up to 4 weeks.
  • Support tickets and emails to us: until your request is resolved, then up to 12 months.
  • Cloudflare, Resend, Google: according to their own retention periods.

Legal retention duties or ongoing legal disputes can extend these periods for the data affected.

8. Security

Traffic is encrypted with TLS. Passwords are stored as Argon2id hashes, two-factor secrets are encrypted with AES-256-GCM, and refresh tokens and recovery phrases are stored only as hashes. Sign-in tokens never reach scripts on our website. No system is perfectly secure, and we cannot promise that data can never be accessed by unauthorized parties.

9. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Contact us at [email protected]. We respond within one month.

Much of this you can do yourself in the dashboard: change your username and profile picture, see your sessions, activity and connected apps, disconnect apps and delete your account. Because we do not store your email address, we may ask you to confirm a request from your signed-in account so we can be sure it is yours.

You also have the right to complain to a supervisory authority. For us this is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, or the authority in your country of residence.

10. Automated decisions

We do not make decisions with legal effect based solely on automated processing. To protect accounts, sign-ins are temporarily blocked after repeated failed attempts, and passwords known from data breaches are rejected. These measures are temporary or can be avoided by choosing another password.

11. Minimum age

CNS Accounts is for people aged 16 or older.

12. Changes

We will update this policy if the service or the law changes and show the date at the top. Material changes will be announced in the service.