Privacy notice

Last updated: 2 October 2026

Avila Labs accounts let you sign in to avilalabs.org services. This notice says what we keep, why, and how to remove it.

What we store

Your email address, so you can sign in and so we can send account emails.
A one-way hash of your password (Argon2id). We never store or see the password itself.
Sign-in sessions: a hash of the session cookie value, when it was created and last used, and your browser's user-agent string, so you can stay signed in and spot unfamiliar sessions.
Short-lived records of failed sign-ins and email requests, keyed by email address and network address, used only to block abuse. They expire on their own.
The fields of work you choose to show on your dashboard, if you choose any.

No advertising, no tracking, no analytics, no third-party scripts. The only cookie is the sign-in cookie, which is needed for the site to work.
We do not sell or share your data. We do not use it to train models.

Hetzner Online hosts the server, in the United States.
Resend sends account emails (verification and password reset) on our behalf. It receives your email address and the message.

Nobody else receives your data unless the law requires it.

Until you delete your account. Sessions end after 30 days without use. Abuse-prevention records are deleted within a few days. Server backups containing your data are overwritten within 14 days of deletion.
If an account's email address is never confirmed, the account is deleted after 7 days.

Delete your account at any time from your account settings. This removes your email, password hash, sessions and everything tied to the account.
To ask what we hold about you, to correct it, or for any privacy question, email privacy@avilalabs.org.

Accounts are not intended for anyone under 16.

If this notice changes in a way that matters, we will say so here and, for significant changes, email account holders.