Skip to content
Magnetite Source code

Legal

Privacy policy

Last updated: 10 November 2026

In short

This website sets no cookies. It counts visits with Umami, an open-source tool we run on our own servers in Germany, without storing your IP address. The Magnetite browser sends no telemetry and needs no account. The details follow.

1. Who is responsible

Responsible for this website (the controller under the GDPR) is StackForge UG (haftungsbeschränkt), Bergstraße 4, 84107 Weihmichl, Germany. For anything about your data, write to privacy@stack-forge.eu. See also the imprint.

2. This website

What it does not do

  • No cookies and no other storage in your browser. The site’s own scripts only run its animations and the live demo of the sidebar; they send nothing and store nothing.
  • No advertising, no tracking pixels, no tracking across other websites.
  • No content from other companies. Text, images, styles, scripts and the one web font come from this server; the one exception is the statistics script described below, which comes from our own statistics server. There are no embedded videos, maps or social media buttons. The live demo shows sample pages that are part of this site; it loads no website.
  • No forms. We do not collect anything you type; what you type into the live demo (its command bar, its archive search) stays in the page.
  • Links to other sites, such as GitHub, are plain links: the other site is contacted only if you follow one, and our pages ask your browser not to tell it where you came from.

Visitor statistics

To see how many people visit this site and which pages they read, we use Umami, an open-source analytics tool that we run ourselves on our own infrastructure in Germany.

  • Umami records the page’s address and title, the referring page if your browser sends one, your screen size and your browser’s language.
  • From the request it works out your browser, operating system and device type, and an approximate location looked up from your IP address (at most country, region and city).
  • Your IP address is not stored. Umami sets no cookies and stores nothing in your browser. To count several page views of one visitor as one visit, it computes a hash that changes regularly and cannot be turned back into the data it was made from.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to learn which pages are useful and to improve the site. The data is processed and stored in Germany only; we do not combine it with other data and do not pass it on. You can object to this processing at any time (Art. 21 GDPR): write to privacy@stack-forge.eu. If a content blocker stops Umami’s script, the site works the same.

Hosting and server logs

The site and the statistics server run on our own infrastructure, on servers of a hosting provider in Germany that processes data on our behalf (Art. 28 GDPR). When you open a page, your browser sends the usual request data: your IP address, date and time, the address requested, the referring page if your browser sends one, and your browser’s user agent. We keep these in server logs to deliver the site and to keep it secure, and delete them after 14 days.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a website that works and stays secure. We do not combine this data with other data and do not use it to identify you.

3. The Magnetite browser

Magnetite runs on your device. The Magnetite project receives no data from it: no telemetry, no usage statistics, no account. Nothing below goes to us.

What stays on your device

  • Spaces, tabs, the archive, history, settings and cached site icons live in Magnetite’s data folder, which only your user account can read.
  • Private profiles live in memory. Their tabs are not saved, synced or archived, and their site icons are not cached.
  • Importing from another browser (Arc, Chromium-based browsers, Firefox, Zen) reads that browser’s files on your computer when you click Import, and Arc’s sidebar also on first start. Magnetite keeps only what ends up in the sidebar: addresses, titles and folder names. Nothing is uploaded, and passwords and cookies are never read.
  • The sidebar shows icons only of sites you have opened; it never fetches icons of other sites.
  • Magnetite keeps your last screenshot in memory only, until you dismiss or replace it.

Checking for updates

At start and once a day, Magnetite asks GitHub Releases (GitHub, Inc., USA) whether a new signed version exists. It is a plain request for the latest release, straight from your computer to GitHub: GitHub sees your IP address and the browser’s user agent, and nothing else is sent. You can turn the check off in Settings → About.

Sync

Sync is off until you turn it on. Then it talks to the server you pick in Settings → Sync: Magnetite’s free server at sync.magnetitebrowser.org or one you run yourself. Your devices encrypt everything before upload, and the 24-word sync code never leaves them. A magnetite-sync server stores:

  • the sync chain’s id, which is an anonymous public key;
  • the day the chain was created and the day it was last used;
  • opaque collection ids and version numbers;
  • the encrypted, padded data.

No email address, password, device name, IP address or readable content. The server does not log requests. Chains unused for 400 days are deleted (the operator can change this), and “Delete sync chain” in Settings erases one at once. The chain’s key and its two dates are pseudonymous data: they are not tied to your name or email, but they stay the same for your devices. If you run your own server, you are responsible for it and for what any reverse proxy in front of it logs. Details: sync server README, sync design.

Magnetite’s sync server

sync.magnetitebrowser.org is run by the controller named in section 1 and hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which processes the data on our behalf under a data processing agreement (Art. 28 GDPR). To deliver the service and protect it from abuse, the reverse proxy in front of it processes your IP address while a request runs and to limit how many requests one address can make; it writes no access logs. The legal basis is our legitimate interest in running the service securely (Art. 6(1)(f) GDPR). Backups of the database are kept for 14 days, so a deleted chain is gone from them after that. Using the server needs no sign-up. How it is set up: public instance.

4. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Write to privacy@stack-forge.eu. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77): the one responsible for us, the Bayerisches Landesamt für Datenschutzaufsicht, or the one in the EU Member State where you live or work.

5. Changes

We update this policy when the website or the browser changes. The current version is always on this page, and its history is public in the website’s repository.