--- title: "Privacy policy | Rigel CMS" url: "https://rigelcms.dev/privacy" description: "How FreshJuice processes website usage, GitHub authentication, cookies and editor data for Rigel CMS." --- # Privacy policy Last updated: 25 October 2026 ## Who and what this covers FreshJuice operates rigelcms.dev and the shared GitHub authenticator at auth.rigelcms.dev. We are responsible for the processing we operate through those services. This policy also explains relevant behavior of the published Rigel CMS editor, which may run on a website operated by someone else. A website using Rigel remains responsible for its own content, editor deployment and privacy information. Our GitHub App and authenticator are optional. If you use a custom authenticator, its operator is responsible for that service's processing. ## Website usage analytics We use first-party, cookieless analytics to understand website usage and improve the documentation. We record successful HTML page visits, navigation and outbound-link clicks, scroll milestones and explicitly configured website events. Records can include page paths, sanitized referring URLs and clicked URLs, campaign tags, timestamps, country, device type, browser user-agent, network provider information and bot classification. Referrer and click URLs have credentials, query strings and fragments removed. Campaign tags are recorded separately; do not put personal information or credentials in them. A hash derived from the requesting IP address and the current date helps estimate visitors within that day. We do not store raw IP addresses in the application analytics tables. The hash is pseudonymous, not guaranteed anonymous. Hosting providers still process connection IP addresses to serve requests. Our analytics do not use tracking cookies or advertising pixels. Do Not Track and Global Privacy Control signals do not disable this first-party counting. Cookieless describes how the implementation works; it is not a claim that the data is anonymous or exempt from applicable privacy law. Authentication endpoints and callback data are excluded from website analytics. The separate authenticator does not load the website analytics script. ## Website preferences and search Theme and high-contrast choices are stored in your browser's localStorage under `rigel.preferences`. They are not visitor identifiers and can be removed by clearing this site's browser storage. Documentation search downloads a same-origin index and runs in your browser. Search terms are not sent to a search service. Fonts and website scripts are served from this site rather than a third-party font service. ## GitHub authentication When you use our shared authenticator, GitHub handles your account login and authorization. We do not ask for your GitHub password. Our service temporarily processes the editor's origin, a caller nonce, authorization state, a proof-key verifier, GitHub's authorization code and the tokens returned by GitHub to complete the connection and protect it against forgery. The service exchanges the authorization code on its server, then returns the access token and its lifetime to the approved editor popup opener. It verifies the destination origin but cannot verify that the website runs Rigel or that its operator is trustworthy. Confirm only editor origins you trust. Access is the intersection of your GitHub permissions and the App installation's permissions. A token can access all repositories available to both, not just the repository configured in one editor. The editor can read repository content, save changes and publish pull requests using those permissions. The editor requests GitHub profile and repository-access information to show your identity and check the App installation and write access. This can include your GitHub login, public display name, avatar, profile URL and repository and installation details. Repository changes remain subject to GitHub's terms and retention practices. ## Authentication cookies The shared authenticator uses encrypted, host-only cookies marked HttpOnly and SameSite=Lax, with Secure on its HTTPS deployment. They are used for sign-in security and token handling, not advertising: - `__Host-rigel-consent`: the approved editor destination, caller nonce and form protection for public-mode confirmation; a maximum age of 10 minutes. - `__Host-rigel-state`: temporary authorization state and proof-key information; a maximum age of 10 minutes. It is cleared when the callback is processed. - `__Host-rigel-refresh`: an encrypted GitHub refresh token with the expiry returned by GitHub. It can be replaced during an authorized refresh. The names above describe HTTPS production cookies. Local HTTP development uses names without the `__Host-` prefix. The gateway's refresh endpoint accepts only protected same-origin requests. RC1 editors on other origins reopen GitHub sign-in when their access token expires; the refresh cookie does not provide automatic cross-origin renewal. ## Editor storage, content and sign-out The published RC1 editor stores its access token, expiry and connection scope in localStorage on the editor's origin under `rigelcms.session` so the session can survive a reload. The scope includes the authenticator, repository, branch and App slug. This storage is readable by scripts on that origin; use a trusted editor website and browser. Signing out clears the editor's stored session. It does not revoke GitHub authorization or clear cookies on the separate authenticator domain. To remove access, revoke the App in GitHub settings; you can also remove an installation or its repository grants and clear browser storage for both origins. Unsaved edits stay in the editor's memory until Save. Local-mode saves write to the site's local files; GitHub-mode saves write to its repository branch. The authentication service has no repository-content database and does not store your site's files as part of token exchange. Editor settings and optional media-provider credentials may also be stored in the editor's browser storage. Optional stock-image searches, downloads, hotlinks or embeds can contact their selected providers. Those features are separate from this website's documentation search and follow the selected provider's policies. ## Diagnostics and public MCP The authenticator reports failures to help diagnose connection problems. Reports can include sanitized exception details and stacks, fixed failure categories, authorization or refresh flow, request path and method, and an upstream response status. Reporting filters known credentials, authorization codes, state values and recognized token patterns. It is configured not to attach raw callback URLs, request headers, cookies or GitHub response bodies. Filtering is a safeguard, not a guarantee that every possible sensitive value can be recognized. Application request logging is disabled in our website and authentication Worker configurations. This does not disable the separate diagnostic reporting or the hosting provider's own processing. The public documentation MCP endpoint processes requests to return project and authentication information. It does not have access to your private repositories or a private installation, and its handler does not store chat history or tool arguments in an application database. Do not submit credentials or private content. Your MCP client and AI provider have their own data practices. ## Providers and international processing Cloudflare hosts the website and authenticator and provides storage for website analytics. It processes network information to deliver and protect requests. GitHub provides account authorization, App permissions and repository operations. Their services can involve processing outside your country. We do not claim that all processing stays in one country or region. See [Cloudflare's privacy policy](https://www.cloudflare.com/privacypolicy/) and [GitHub's privacy statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement). External links and separately operated editors or authentication services have their own policies. ## Purposes and legal grounds We process authentication information to provide the connection you request, and security and diagnostic information to protect and maintain the services. Our interests in understanding website usage and improving documentation also support the first-party analytics described above. The applicable legal ground depends on the processing and the law that applies; where consent is required, it must be obtained. Confirming an editor destination is not blanket consent to unrelated processing. ## Retention and removal Temporary sign-in cookies expire as described above. Refresh cookies follow the token lifetime supplied by GitHub. Editor localStorage has no automatic browser expiry: the editor removes invalid or expired sessions when it checks them, and sign-out or clearing browser storage removes the saved session. The applications do not enforce an automatic deletion schedule for website analytics or authentication diagnostic records. Removal requires operator action or a separately configured storage policy. We do not promise a fixed deletion period that the service does not enforce. GitHub, Cloudflare, your website operator and other selected providers maintain their own records under their policies. ## Your requests and contact Depending on applicable law, you may have rights to access, correct or delete personal data, restrict processing, object to processing or request portability. You may also complain to your local data protection authority. We may need information to verify and locate a request; a rotating visitor hash does not necessarily let us identify a particular person's analytics records. For questions or to request a private contact channel, open an issue on [Rigel's GitHub repository](https://github.com/rigel-cms/rigel/issues). Issues are public: do not post personal information, credentials, tokens or private repository content. State that you need a private channel without including the sensitive details. ## Changes We may update this policy as the services change. The date above identifies the latest revision.