Privacy policy draft

Refundora uses first-party, privacy-minimized analytics to understand whether real visitors reach public pages. A random browser identifier, visited path, external referrer or UTM source, device category, and timestamp may be recorded. Raw IP addresses and full user-agent strings are not stored, known bots are filtered, and admin pages are excluded.

This starter is also configured for private object storage and scheduled evidence deletion. Before accepting files or payments, replace this draft with a jurisdiction-specific policy describing the exact data collected, retention period, processors, user deletion rights, and contact information.

Planned defaults

Private Timeweb S3 bucket, signed upload URLs, separate credentials from other projects, no public evidence URLs, restricted file types, and automatic deletion of originals after the stated retention window.