Privacy policy

This is an English translation of the Polish privacy policy (Polityka prywatności). If the two versions differ, the Polish version prevails.

Data controller: Damian Ryczkowski, email: kontakt@freessl.pl.

What happens in your browser and what happens on the server

The generator runs in your browser. The private key of the certificate and your Let's Encrypt account key are created in your browser and never leave it. The generator connects directly to Let's Encrypt (the certificate issuer) and to Cloudflare's DNS service (cloudflare-dns.com) to check the TXT record. The “What this site sends” panel shows every connection as it happens. You need an account to generate certificates. Without logging in (home page, articles, guides, legal pages) we don't store cookies and don't collect any data other than the server logs described below, unless you agree to visitor statistics.

Account data

• email address and password, the password stored only as a hash (scrypt), the date the account was created, the hosting you selected, the account language (Polish or English, for emails);
• for each saved certificate: domain names, validity dates, key type, mode and the public certificate chain. We don't store the private key and have no access to it;
• server logs: IP address, time and address of the request, and headers sent by the browser (e.g. its name and version), kept for up to 7 days for security.

Why

• running your account and certificate list, sending activation links and renewal reminders: performance of a contract (Art. 6(1)(b) GDPR);
• security and protection against abuse: legitimate interest (Art. 6(1)(f) GDPR);
• visitor statistics on the information pages: your consent (Art. 6(1)(a) GDPR).

There are no ads and no profiling. Visitor statistics only run with your consent. We don't sell data.

Only the administrator has access to account data, through a panel protected by a password and a code from an authenticator app. It is used to handle requests, remove abuse and check that the service works.

Visitor statistics (Google Analytics)

On the information pages (home page, articles, guides, FAQ, privacy policy and terms of service) we count visits with Google Analytics 4, but only if you click “I agree” in the box at the bottom of the page. Without consent the Google script is not loaded. Google Analytics never runs on the generator page, in your account, in the dashboard or in the administration panel, not even after you consent: on those pages the browser does not allow connections to Google, because the security header (Content-Security-Policy) forbids it.

After you consent, Google Analytics stores the cookies _ga and _ga_REDFYKDR84 in your browser (valid for up to 2 years) and sends Google the address of the page you visit, the address of the page you came from, and information about your browser, device and approximate location (country, city). Google Analytics 4 does not store IP addresses. We have turned off Google signals and all advertising features. We only look at the data in aggregate reports.

You can withdraw your consent at any time: click “Cookie settings” in the page footer and then “I don't agree”. Data sending is then switched off and the _ga cookies are deleted.

Who we share data with

• OVH SAS (France, European Union) as the provider of the server and of the mailbox we send emails from.
• Google Ireland Limited (Ireland, European Union) as the provider of Google Analytics, only after you consent to statistics. Data may also be transferred to Google LLC in the USA, which participates in the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023).

The “Buy a coffee” link leads to buycoffee.to. We don't pass it any data. If you choose to support the site, buycoffee.to processes your data under its own privacy policy.

The “Check a certificate” tool connects to the site you enter only to read its certificate. For 30 days we keep the checked domain, the time and the result (for statistics on how the tool is used), without the IP address and without linking them to an account, then we delete them automatically. The result has its own address containing the checked domain (e.g. /en/check-certificate/example.com), so the domain also ends up in the server logs, which we keep for up to 7 days. The server also counts in memory how many checks came from one IP address, to limit abuse (the counter disappears within a day at the latest).

How long

Until the account is deleted. You delete the account yourself in the dashboard, and we then erase all data immediately. An account whose email address is not confirmed within 7 days is deleted automatically. Entries for test certificates and checks made with the “Check a certificate” tool are deleted automatically after 30 days. Database backups are kept for 14 days, server logs for up to 7 days, and statistics data in Google Analytics for 14 months.

Cookies and browser storage

We use one session cookie (sid) after you log in. It is necessary for the account to work, so it doesn't require consent. Without logging in, the site only stores cookies if you agree to visitor statistics (the Google Analytics cookies described above). Your choice itself, consent or refusal, is remembered for a year in your browser's storage (localStorage, entry “freessl-zgoda”) so we don't have to ask on every page.

When you go to the generator from a “Check a certificate” result, the generator remembers the domain names in this browser tab (sessionStorage, entry “freessl-domeny”) so they are not lost when you log in. The entry is removed when you start the verification or close the tab.

The generator remembers your Let's Encrypt account key in your browser's storage (IndexedDB), separately for test and production mode, so that further attempts and renewals don't create new Let's Encrypt accounts. The key never leaves the browser, never reaches our server, and the browser does not allow it to be read or exported. You can delete it with the “Forget it” button in the generator or by clearing the site data in your browser settings. We never store the certificate's private key anywhere.

Your rights

You have the right to access your data, to rectify, erase and restrict its processing, to data portability and to object, as well as the right to lodge a complaint with a supervisory authority; in Poland this is the President of the Personal Data Protection Office (UODO). You can withdraw your consent to statistics at any time; this does not affect the lawfulness of processing before withdrawal. Write to kontakt@freessl.pl.