TarXZ Quarry Service
For software meant to last.

Privacy

TarXZ Quarry Service adheres to data sovereignty and data minimization. We do not monetize personal data or collect irrelevant information, providing a transparent and privacy-first hosting environment.

1. Information We Collect and Process

  • Public Repositories & Commits: Source code, commit logs, author signatures, wiki docs, tickets, and forum discussions in public repositories are public by design and stored durably in the repository's SQLite database.
  • Platform Administrator Credentials: The platform only stores administrator usernames in the local database. Passwords are irreversibly hashed using Argon2id with strong per-user salts. Plaintext passwords are never stored.
  • Operational Access Logs: To ensure server security, troubleshoot faults, and prevent malicious attacks, standard access logs (timestamp, path, client IP, status, duration) are recorded locally and rotated automatically.

2. Cookies & Local Storage

We use only essential first-party functional cookies required for core operation. No third-party trackers or cross-site tracking tools are used:

  • quarry_session：Issued solely for administrator dashboard sessions, protected with HttpOnly and SameSite=Lax flags, destroyed immediately on logout;
  • locale：Stores your language preference (Chinese or English) when toggled;
  • Repository-Scoped Cookies: Repository-level sign-in cookies are handled exclusively by Fossil upstream processes and completely isolated from platform administrative credentials.

3. Data Sharing & Third Parties

TarXZ Quarry Service does not sell, rent, or trade personal data. Data transmission occurs only under administrator-directed operational actions:

  • When automated Git push is enabled, repository data is mirrored to the administrator-configured remote endpoint (e.g. GitHub, GitLab, Gitea);
  • When remote Fossil sync is enabled, the platform communicates with the designated remote Fossil server.

4. Data Security & Your Rights

Sensitive credentials (remote passwords, Git tokens) are encrypted at rest with authenticated AES-256-GCM. You have the right to request access, correction, or deletion of your hosted repositories. Contact the operator with any inquiries.