Privacy Policy
Version 2026-11-08. Effective .
This policy explains what personal data Portifact collects, why, how long we keep it and what you can do about it. It covers the hosted service at portifact.com and portifact.dev. Words such as "artifact" and "comment" mean the same as in the Terms of Service.
Who is responsible
Portifact is run by Leynier Gutiérrez González, an individual, who decides how your data is used. For any privacy question or request, write to privacy@portifact.com.
In short
- We keep only what we need to run Portifact: your email, how you sign in, your sessions, what you publish and the settings you choose.
- We do not sell your data, show ads, use tracking or analytics cookies, or train AI models on your content.
- Artifacts are private to you until you share them.
- Cloudflare hosts Portifact and processes data on our behalf.
What we collect
- Account. Your email address and whether it is verified, and the name and profile picture that Google or GitHub share when you sign in with them. For Google and GitHub we keep the stable ID of your account there. We do not keep their access tokens.
- Human check. When you create an account, and for your first comments on other people's artifacts, Cloudflare Turnstile checks that you are a person and not an automated program. It looks at signals from your browser and your IP address, and tells us only whether the check passed. We keep a short-lived cookie saying it passed, and nothing else.
- Terms acceptance. The version of the terms you accepted, including your confirmation that you are 18 or older, and when you accepted it.
- Sign-in codes. Codes sent to your email are stored only as hashes. To limit abuse, we count requests per email address (using a keyed hash, never the address itself) and per IP address. We also count how many emails we send each day, without any data about the recipients.
- Undeliverable addresses. When our email provider tells us that mail to an address bounced permanently or was reported as spam, or refuses to send to it for that reason, we stop sending sign-in codes to that address. We record a hash of the address, a masked form of it (its first character and its domain), the reason and the dates, never the full address.
- Sessions and tokens. Your sessions on app.portifact.com, with the IP address and browser that created them, and the clients, scopes and tokens you approve for the CLI and MCP clients.
- Content. The files you publish and any sources you upload, with their names, sizes, checksums and versions, and each artifact's settings, including the email addresses you allow to open it.
- Comments. When comments are available, what you write, who wrote it, when, and the part of the artifact it refers to.
- Access logs (planned). When a signed-in person opens an artifact that is not public, its creator will see that person's email and the time. Anonymous visitors of public artifacts are not identified.
- Reports. What you tell us when you report abuse, and your email if you give it. To limit abuse of the report form we count reports per IP address.
- Technical logs. A sample of requests to our servers, used to fix problems and stop abuse. They never include tokens, cookies, sign-in codes, signed URLs or the full text of comments.
How we use it
- To run Portifact: sign you in, publish and serve your artifacts to the people you allow, and keep your quotas.
- To keep it secure: limit request rates, detect and stop abuse, and investigate reports.
- To contact you: send sign-in codes and, later, service notices such as an artifact about to expire or a change to these policies.
- To meet legal obligations.
Our legal bases, where the law asks for one, are performing our agreement with you (the terms), our legitimate interest in keeping Portifact secure and working, and complying with the law.
Where data is stored
Data is stored and processed by Cloudflare, which runs servers in many countries, including the United States. By using Portifact, your data may be processed outside the country where you live.
How long we keep it
| Data | How long |
|---|---|
| Account and terms acceptance | While your account exists |
| Active artifacts | 30 days from the last publication or renewal |
| Archived artifacts | Six months from archiving, then deleted |
| Previous versions of an artifact | Up to two, for 7 days after a newer one is published |
| Deleted artifacts | Deleted from storage, keeping only a marker of the ID so it is never reused |
| Deleted accounts | Sessions, tokens and sign-in identities at once; artifacts, files and comments within hours; only a marker of the internal ID and artifact IDs is kept |
| Abuse reports | As long as needed to handle the report and prevent repeated abuse; the reporter's email is erased when that account is deleted |
| Sessions | Until they expire, 7 days after last use, or until you sign out |
| Sign-in codes | 5 minutes, and used once |
| Rate-limit counters | Up to 2 days |
| Undeliverable address records | 30 days after a permanent bounce, 180 days after a spam report and 7 days after the provider refuses a send, or until you ask us to review it |
| Daily email counts (with no data about recipients) | The current and previous month |
| Traffic counters (requests and bytes your artifacts served each month, with no data about visitors) | The current and previous month, or until your account is deleted |
| Access logs (planned) | 30 days |
| Database backups | Up to 30 days; restoring one never brings back deleted content |
| Technical logs | A short period set by Cloudflare's logging service |
Your rights and choices
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it. You can always:
- see and change your artifacts and their access in the dashboard or the CLI;
- delete any artifact at any time;
- sign out of the CLI with
portifact logout, which revokes its token; - download a copy of your data (as JSON, with links to your files) and delete your account from the Account page of the dashboard, or ask us by writing to privacy@portifact.com.
When an account is deleted, its sessions, tokens and sign-in identities end at once and its artifacts stop being served; within hours we delete its artifacts and files, and its comments on other people's artifacts. A comment that others replied to is replaced by a "message deleted" marker. We keep only a minimal record of the account's internal ID and of its artifact IDs, so those addresses are never given to anyone else, and we erase your email from any abuse report you sent. We answer requests within 30 days and do not charge for them. You can also complain to your local data protection authority.
Security
Your account and the API live on portifact.com, and artifacts are served from their own addresses on portifact.dev, so a published page cannot act on your account. Cookies are restricted to the address that set them, sign-in codes and tokens are never logged, and storage is reachable only through Portifact's access checks. The details are in our security documentation. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you as the law requires.
Children
Portifact is only for people 18 or older. If we learn that an account belongs to someone younger, we close it and delete its data. If you believe this is the case, write to privacy@portifact.com.
Changes to this policy
We will publish any update on this page with a new version and effective date, and tell you in advance about significant changes. Changes to this policy are part of the version you accept with the Terms of Service.
Contact
Write to privacy@portifact.com for anything about your data.