Back to the configurator

Legal

Privacy Policy

Last updated: 2026-06-21

This Privacy Policy explains how oglimmer.com / Oliver Zimpasser ("we", "our", "us") processes personal data when you use Renovate Initializr (the "Service"). It applies to all visitors and to signed‑in users of the dashboard.

1. Controller

Controller within the meaning of Art. 4(7) GDPR:
Oliver Zimpasser, Berliner Str. 39a, 63110 Rodgau, Germany
Email: oglimmer@gmail.com

We have not appointed a Data Protection Officer because we are not required to do so under Art. 37 GDPR.

2. Data We Process

We process the following categories of personal data, depending on how you use the Service:

  • No data is required to use the core tool. Building a configuration, the live preview and downloading the resulting renovate.json happen entirely in your browser and do not require an account or send personal data to us.
  • Configuration content you submit for review: when you use the "AI feedback" feature or the public REST API, the configuration text you provide is sent to our backend and on to our AI provider (see Section 5). A renovate.json is not normally personal data, but you control what you paste in.
  • Account data from your Git host (only if you sign in to the dashboard): the OAuth provider (GitHub or GitLab), your numeric provider user id, your login/username, your display name, and your avatar URL. This is stored in our database to recognise you across sessions.
  • OAuth access token (only while signed in): issued by your Git host and used to call its API on your behalf to list your repositories and read their Renovate configuration. To do this the Service requests the GitHub repo and read:org scopes, or the GitLab read_api scope. These tokens may technically grant broader access than the Service uses; the Service only reads repository metadata and Renovate configuration files and never creates, modifies or deletes anything in your repositories. The token is held only for the duration of your session (refreshed where your provider issues short‑lived tokens) and is not stored in our database.
  • Tracked repositories (only if you sign in): the full names (e.g. owner/repo) of the repositories you choose to track on the dashboard.
  • Technical log data: as with any web service, the application server and the hosting / ingress infrastructure may record standard technical logs — which can include your IP address — for security and troubleshooting. The application itself does not keep a per‑request access log, but configuration text you submit for AI review may appear in an error log if the AI provider returns an unparseable response. We do not use analytics, device fingerprinting or cross‑site tracking.

3. Whether You Have to Provide Data

You are not under any statutory or contractual obligation to provide personal data. You can use the configuration builder, preview, download and REST API without an account. Signing in is only necessary if you want to use the dashboard to compare your repositories' configuration; if you do not sign in, that feature is simply unavailable to you.

4. Purposes and Legal Bases

  • Providing the AI review (Art. 6(1)(b) GDPR): processing the configuration you submit and returning a summary, issues and an improved configuration. This is performed at your request.
  • Dashboard sign‑in and repository comparison (Art. 6(1)(b) GDPR): authenticating you via your Git host, storing your account data and tracked repositories, and using your access token to read your repositories' Renovate configuration so the dashboard can display it.
  • Security, abuse prevention and troubleshooting (Art. 6(1)(f) GDPR): our legitimate interest is to keep the Service running, secure and free of misuse, supported by the technical log data described in Section 2.
  • Compliance with legal obligations (Art. 6(1)(c) GDPR): where applicable law requires us to retain or disclose data.

We do not carry out any automated decision‑making, including profiling, that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR.

5. AI-Assisted Review

The "AI feedback" feature and the REST API call a third‑party AI provider, DeepSeek (operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., People's Republic of China), to analyse a configuration. Only the configuration text you submit for that single request is transmitted. No account data, access tokens, tracked‑repository lists or server logs are sent. This feature is only active when the operator of the instance has configured an AI provider API key.

6. Recipients of Your Data

We disclose personal data only to the following categories of recipients:

  • Your Git host (GitHub or GitLab): when you sign in, you authenticate directly with them and we receive your basic profile from them. Your use of their login is also subject to their own privacy policy; they act as an independent controller for their platform.
  • DeepSeek: receives the configuration text you submit for review (see Section 5), acting as a processor / recipient for that request.
  • Hosting and infrastructure providers on whose servers this instance of the Service is operated; they act as processors under Art. 28 GDPR.

7. International Transfers

When you use the AI review feature, the configuration text you submit is transferred to DeepSeek in the People's Republic of China, for which the European Commission has not issued an adequacy decision. Because the review is carried out only at your explicit request and is necessary to provide the feature you asked for, we rely on the derogations in Art. 49(1)(a) and (b) GDPR for this transfer. The transfer carries the risks generally associated with transfers to countries without an adequacy decision; if you do not wish your configuration to be transferred, simply do not use the AI review feature. You can request more information by contacting us (see Section 11).

8. Cookies and Local Storage

When you sign in to the dashboard, we set the following strictly necessary cookies:

  • A session cookie — keeps you signed in to the dashboard for the duration of your session.
  • XSRF-TOKEN — a cross‑site request forgery (CSRF) protection token that the frontend reads and echoes back on state‑changing requests.

The Service also uses your browser's sessionStorage to hand a configuration over from the dashboard to the editor ("Open in editor"); this stays in your browser and is not sent to us.

These items are strictly necessary to provide the functionality you have requested and therefore do not require consent under § 25 (2) Nr. 2 TDDDG. We do not use analytics, advertising or cross‑site tracking cookies of any kind.

9. Retention and Deletion

  • Submitted configuration content: processed transiently to produce the review and returned to you; we do not persist it in our database after the response is returned. It may appear briefly in server logs in error situations.
  • Account data and tracked repositories: retained for as long as you use the dashboard. You can revoke the Service's access from your Git host at any time, and you can ask us to delete your account data and tracked‑repository list (see Section 10 and 11).
  • OAuth access token: held only for the duration of your session and discarded afterwards; not stored in our database.
  • Technical / infrastructure logs: retained for a short period (typically a few days) unless we have a concrete reason to keep them longer to investigate an incident.

10. Security

We implement appropriate technical and organisational measures within the meaning of Art. 32 GDPR to protect your data, including transport encryption (HTTPS), authenticated sessions, CSRF protection and minimisation of the data we collect. No online service can guarantee absolute security.

11. Your Rights

Under the GDPR you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR).
  • Right to rectification of inaccurate data (Art. 16 GDPR).
  • Right to erasure ("right to be forgotten") (Art. 17 GDPR).
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability for data you have provided to us (Art. 20 GDPR).

Right to object (Art. 21 GDPR). You have the right to object, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interests (Art. 6(1)(f) GDPR), in particular the technical‑log processing described in Sections 2 and 4. If you object, we will stop processing the data in question unless we can demonstrate compelling legitimate grounds that override your interests or the processing is needed to establish, exercise or defend legal claims.

To exercise any of these rights, contact us at oglimmer@gmail.com. You also have the right to lodge a complaint with a supervisory authority. The competent authority for the controller is the Hessischer Beauftragter für Datenschutz und Informationsfreiheit, Wiesbaden, Germany; you may also lodge a complaint with the supervisory authority of your habitual residence or place of work.

12. Children

The Service is not intended for children under 16. Do not sign in or submit content if you are under 16.

13. Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page reflects the effective date of the current version.

14. Contact

For privacy questions or requests, contact: oglimmer@gmail.com.