Privacy
Group Matters is free software (AGPL-3.0). Each server is run by an operator, the person or organisation that gave your group its link. That operator is responsible for the data on it and is who to contact (see “Contact” below).
What is stored
- What your group enters: matters (titles, notes, dates, status), links to the tools where they're worked on, the tool list and the charter.
- The display names people type. They aren't verified and there are no accounts, so a nickname is fine.
- An activity log of who changed what and when, with those names.
- Nothing else about you: no email address, no IP address and no device information are stored by the application. (The operator's web server or hosting provider may keep ordinary access logs of its own.)
Who can see it
Anyone who has a space's view or edit link can read everything in it, names and activity log included. Keep the links as private as the content. The Atom feed and the calendar (ICS) of a space contain its view link, so anyone or any service you give them to can read the space too.
The activity log is permanent
The log is append-only: the application has no way to edit or delete an entry, and the database refuses it. Matters aren't deleted either, only archived. This is deliberate: a group that records how its matters were settled needs a history it can trust.
That doesn't override your rights over your own name. If you want yours replaced (by a placeholder such as “former member”), ask the operator; they do it directly in the database, outside the application.
Cookies and browser storage
There are no cookies. Your browser keeps a few things on your device so the app works as you left it; none of them is a tracker, and none is sent anywhere except the display name, which goes with each change you make:
- your display name;
- when you last visited, to show “changed since your last visit”;
- whether you chose to edit or only to view, per space;
- dashboard preferences (hidden widgets, monthly goal).
Clearing this site's data in your browser removes all of it.
No trackers
No analytics, no advertising, no third-party scripts, fonts or images. The page's content security policy forbids loading them. Your browser doesn't tell other sites which page you came from.
Pages the server fetches
When a matter links to a public page (GitHub, GitLab, Loomio, Polis, Decidim…), the server fetches that page or its public API to show and update its status. Only that URL is requested; none of your names or notes are sent. Some of these requests carry the operator's own API token (never yours).
When a group adds a tool to its list, the server fetches that site's icon (favicon) once and keeps a copy, so it can be shown next to the tool's name. The icons of the built-in tools come with the app. Either way, they're served from this server: your browser never contacts those sites to show them.
Your rights
You can ask the operator to show you the data that mentions you, to correct it, or to remove it. Anyone with edit access can also download a complete copy of a space as JSON (menu → Export). Your data stays on the server until the operator deletes the space; the operator may keep backups for a limited time.
Hosting
This server runs on a virtual private server (VPS) from Ionos in the EU.
Contact
Use the “Contact” link at the bottom of this page, or ask the group that gave you your link. The source code, including how all of this works, is under “Source”.