LaunchRepoLaunchRepo
Privacy
Who is responsible?
The CodeCave GmbH, Alfred-Nobel-Str. 29, 50226 Frechen, Germany, is responsible for personal data processed through LaunchRepo. Contact info@thecodecave.de for privacy requests.
Browsing this website
Our hosting provider Railway processes connection data such as IP address, requested URL, timestamp and browser information to deliver and secure the website. We use this data for reliable operation and abuse prevention based on our legitimate interests (Art. 6 (1) (f) GDPR). Fonts and interface assets are served locally. We load the X browser pixel only for visitors whose connection is located outside the EU/EEA, the United Kingdom and Switzerland. Cloudflare derives the country from the IP address and supplies cf-ipcountry to our uncached /api/geo/ endpoint; we do not store or log that country. Visitors connecting from these regions receive no browser pixel. If the country is missing or unknown, indicates Tor, or the check fails or takes longer than 1.5 seconds, the pixel is not loaded.
Website analytics (Rybbit)
To understand how the website is used we run Rybbit, an open-source analytics tool, on infrastructure operated by us; no analytics data is sent to a third-party analytics provider. Rybbit sets no cookies and stores no identifiers on your device. It records the pages you view, the referring website, page title, screen size, browser, operating system, language, device type and the country and region derived from your IP address; the IP address itself is not stored. We also record interaction events on product and content pages, such as which section or comparison table became visible, how far an article was read, which button, link or FAQ entry was clicked, whether the price calculator was used and outbound links that were clicked. These events contain only fixed labels, never anything you typed. Visitors are counted with a pseudonymous identifier derived from a hash of IP address and browser information with a salt that changes daily, so visits cannot be linked across days. Legal basis is our legitimate interest in measuring and improving our website (Art. 6 (1) (f) GDPR); because nothing is stored on or read from your device, no consent under § 25 TDDDG is required. The analytics script is not loaded if your browser sends a Do Not Track or Global Privacy Control signal, and it is not loaded on the access and API pages. We keep the analytics data for as long as we need the statistics and delete or aggregate it afterwards.
Purchases and access
When purchasing is available and you choose to buy, Stripe processes your payment details. We receive your email, payment reference and payment status, not your full card details. Resend delivers access emails. Convex stores purchase and access records. Connecting GitHub links its stable account ID and username to your purchase so we can invite that account to the repository and verify access. These operations fulfill your order (Art. 6 (1) (b) GDPR).
Conversion measurement (X Ads)
The following describes our server-side events. We advertise on X (Twitter) and measure which ads lead to checkout starts and purchases. We send two types of event to X. “Checkout Start” is sent immediately after a Stripe Checkout session is created, before payment, and only if that checkout has its own click identifier (twclid) from an X ad. It contains that click identifier and, where available, your IP address and browser identification (user agent), plus a reference in the form checkout:<Stripe session ID> to prevent duplicate counting; no email address or purchase value is sent. “Purchase” is sent after payment has been confirmed and the purchase recorded. It contains the SHA-256 hash of your purchase email address, the click identifier if available, your IP address and user agent if available, the paid amount, currency and an order reference. Both events also contain the event time, an event identifier, an item count of one and the description “LaunchRepo license”. The email address is irreversibly hashed before transmission; X never receives it in plain text. The recipient is X Corp., 865 FM 1209, Building 2, Bastrop, TX 78602, USA, acting as its own controller; we base the resulting transfer to the USA on the European Commission’s standard contractual clauses. The legal basis is our legitimate interest in measuring the commercial effectiveness of our advertising (Art. 6 (1) (f) GDPR). You can object to this processing at any time at info@thecodecave.de.
X browser pixel and website audiences
We load the X browser pixel only for visitors whose connection is located outside the EU/EEA, the United Kingdom and Switzerland. Cloudflare derives the country from the IP address and supplies cf-ipcountry to our uncached /api/geo/ endpoint; we do not store or log that country. Visitors connecting from these regions receive no browser pixel. If the country is missing or unknown, indicates Tor, or the check fails or takes longer than 1.5 seconds, the pixel is not loaded. For eligible visitors we load X Corp.’s script https://static.ads-twitter.com/uwt.js and configure pixel rfg9g. It records page visits and sends the page URL, referrer, IP address, browser information and available advertising identifiers to X. Only if the pixel has actually loaded and a valid Stripe Checkout URL is returned, immediately before redirect and before payment, the browser also sends Checkout Start (tw-rfg9g-rfjm9) with conversion_id checkout:<Stripe session ID>, even without twclid. This reference deduplicates it with an eligible server event. We add no email, purchase amount or currency to this browser event; Purchase remains server-only. X may set or read advertising cookies, including the first-party click-ID cookie _twclid and third-party muc_ads and personalization_id cookies, depending on browser and X settings. X uses these identifiers to link visits, measure ads and build website audiences for retargeting. The recipient is X Corp., an independent controller in the USA; the transfer safeguards described above also apply. Our stated GDPR basis is legitimate interests in advertising measurement and audience building (Art. 6 (1) (f)); this does not replace any required consent for device storage/access under § 25 TDDDG. We do not ask for consent before loading the pixel. It is excluded on access, API and affiliate-account pages, local/test hosts, and when Do Not Track or Global Privacy Control is enabled. To object, contact info@thecodecave.de. Enable DNT/GPC to prevent future loading here; block tracking/scripts or third-party cookies and delete existing cookies in your browser. Blocking cookies alone may not stop all requests. X’s personalization and advertising choices are at https://x.com/settings/personalization. Cookie details: https://help.x.com/en/business-and-advertising/about-conversion-tracking.
Login and retention
Access links expire after 15 minutes and can be used once. A necessary, secure session cookie supports access for up to 24 hours. We retain purchase records as needed to deliver the license and meet legal recordkeeping obligations; access/security records are retained as required for operation and abuse prevention. Contact us to request deletion of records no longer needed.
Providers and your rights
Our providers may process data outside the European Economic Area. Applicable transfer safeguards and processing agreements must cover these services. You can request access, correction, deletion, restriction and portability where applicable, object to processing based on legitimate interests, and complain to a data protection authority. In North Rhine-Westphalia: ldi.nrw.de.