Stay private

# GDPR / CCPA compliant

The European privacy standard GDPR was developed here in Germany. It's not perfect, but we proudly support it since 2018↗.

# No cookie banner

Notice something missing? There is no cookie consent banner on any fortrabbit website. Where advertising cookies need opt-in consent — the EEA, the UK, Switzerland, Brazil and Quebec — no advertising tag is loaded here, so there is nothing to consent to. Everywhere else, a Google Ads remarketing tag runs on www, docs and blog and sets advertising cookies, which is what the notice-and-opt-out laws in those jurisdictions allow. The dashboard carries no advertising tag at all.

Functional cookies are used on every property: a session, a currency, a color scheme. Those are set by fortrabbit and shared with no one.

# What an ad blocker finds

An ad blocker flags the Google Ads tag wherever it loads. It finds no fingerprinting and no session recording. Visit statistics come from Fathom, configured without cookies. No page here depends on the advertising tag, so blocking it breaks nothing.

# Do Not Sell or Share My Personal Information

Under the California CPRA and the comparable state laws, running a remarketing tag counts as sharing personal information for cross-context behavioral advertising. Two settings stop it:

• Global Privacy Control↗ — a browser setting or extension that sends an opt-out signal. fortrabbit reads that signal and loads no advertising tag for that visitor.
• Google Ad Settings↗ — switches off personalized advertising across everything Google serves.

An ad blocker, or a browser that blocks third-party cookies, has the same effect.

# US state privacy rights

Residents of US states with comprehensive privacy laws — California, Colorado, Connecticut, Virginia, Utah and the states that followed — can ask what personal information fortrabbit holds, have it corrected or deleted, and opt out of targeted advertising. Requests go through the DSAR policy, which is open to everyone and not limited to residents of any one place. Personal information is not sold for money.

# No AI feeding

We don't sell or use your data or code training LLMs to replace you one day. We do use AI to create and extend this service. We try to do so in a responsible way, see our AI usage policies.

# Data processing as a service

Beside storing data on our clients directly, we also process data for our clients. Our general data processing agreement serves as the legal basis for doing that.

# 3rd parties transparency

fortrabbit wouldn't be possible without the use of other services. Many of them are based in the US. External service partners are chosen after careful consideration. We try to find a good balance of service level, privacy and other factors, such as environmental impact.

Google is one of them. Where the remarketing tag loads, Google learns that a browser opened www, docs or blog and can show fortrabbit ads to that browser on other sites later. No account data and no app data goes with that tag.

Accounts created after a Google ad click are credited back to that ad. A nightly job sends Google the click ID, the signup time and the time of the first payment, with an identifier made of the event type and the account ID. Name, e-mail address and app data are not sent. Object to it by e-mail to info@fortrabbit.com, see the privacy statement.

We maintain a public list of sub processors, including what data is shared and why.

# Opt-in where possible

Certain platform features are optional. Agree before using the 3rd party customer chat service. Social sign up is also optional, as well as Git deployment with a third party.

# Data minimization

The less we know, the better. Server logs are only stored as long as required and anonymized where possible. Idle accounts are getting deleted automatically. We have a zero inbox mentality when it comes to storing data.

# Deletion of abandoned accounts

We delete old and neglected accounts when all of the following attributes are given:

• no login to our dashboard for a long time
• no access to any team
• no active apps running

We think that is in the best interest of our users for privacy and security. It's easy to sign up again at any time later. We might not inform the Account about an upcoming auto-delete.

# Purpose limitation

Your data is not getting horded. We only store data points for good reasons, either to improve the service experience or to make it more secure.

# Security for privacy

Many of our security features are aimed to protect your privacy. Data is encrypted where possible. Only secure access protocols are allowed. Strict policies and workflows are in place.

# Use cases

fortrabbit is a web hosting to serve websites and web applications. Some data stored by our clients is public, think websites fully accessible from the world wide web. Other data is private, often behind a login, think software services or eCommerce.

# Limits

fortrabbit might not be suited to store very sensible data such as health related, financial data or a lot of personal records. As much as we would personally love to host everything within EU or even just DE bounds, we also want to offer our solution internationally.