This is a translation for convenience. The German version is legally binding.

This policy informs you under Articles 13 and 14 of the General Data Protection Regulation (GDPR) which personal data this forum and the Git portal git.antiqua-blockchain.com (section 18) process, why, and on which legal basis.

1. Controller

AntiQua
c/o Online-Impressum 1936, Europaring 90, 53757 Sankt Augustin, Deutschland
Email: blythex@antiqua-blockchain.com

2. Principles

This forum uses no advertising, no audience measurement and no tracking services. Fonts, emojis, profile and cover images are served from our own server. External services are used only where described below.

3. Hosting and server logs

The forum runs on a server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in a data centre in Helsinki, Finland, within the European Union. A data processing agreement under Article 28 GDPR is in place.

For every request the web server automatically logs IP address, date and time, request method, requested address, HTTP status code, browser identifier (user agent) and referrer, for secure operation, troubleshooting and defence against attacks (Article 6(1)(f) GDPR). Logs are deleted after 30 days.

4. Registration and user account

For an account we process username, email address and password; the password is stored only as a cryptographic hash. You may add further profile details such as name, website, location, birthday, signature, an about-me text and profile or cover images. Without a profile picture, the forum generates a graphic symbol from your user ID on our own server. You confirm your email address via a link we send you. IP addresses used for registration and sign-in are stored with your account to detect abuse and enforce bans.

Legal basis: Article 6(1)(b) GDPR; for IP addresses Article 6(1)(f) GDPR. Data is kept until you delete your account.

5. Posts, reactions, polls and chats

Posts, topics, reactions and your public profile are visible to all visitors, including without signing in, and may be indexed by search engines. Poll votes are stored. Private chat messages are not visible to other users; they are not end-to-end encrypted and are stored on our server. Legal basis: Article 6(1)(b) GDPR. Content is kept until you or the moderators delete it or your account is deleted.

6. Emails

We send emails to confirm your address, reset your password and, depending on your settings, notify you. They are sent through our own mail server on the same infrastructure in Helsinki (Article 6(1)(b) GDPR). Mail server logs are deleted after 30 days.

7. Cookies and local storage

We use only strictly necessary cookies: the session cookie express.sid keeps you signed in and protects forms against forgery (CSRF). It lasts until the end of the session, or up to 14 days with "remember me". The browser's local storage holds drafts, display settings and your reCAPTCHA decision. Legal basis: Section 25(2) no. 2 TDDDG and Article 6(1)(b) and (f) GDPR.

8. Spam protection at registration: StopForumSpam

At registration we check IP address, email address and username against the StopForumSpam database (stopforumspam.com) to reject known spam accounts. The service is privately operated and hosted in the United States. There is neither an adequacy decision nor a certification under the EU-U.S. Data Privacy Framework for this transfer. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in protecting the forum from automated spam registrations.

9. Google reCAPTCHA

On the registration and sign-in pages we use Google reCAPTCHA to tell humans from automated programs. For users in the European Economic Area the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA is loaded only after you consent. It then transmits, among other things, your IP address, browser and device information and your behaviour on the page to Google for evaluation; Google may set cookies. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework. See Google's privacy policy.

Legal basis: your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Without consent, registering or signing in is currently not possible. You can withdraw your consent at any time with effect for the future:

Withdraw reCAPTCHA consent

10. Sign in with GitHub

You may optionally sign in with your GitHub account, provided by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. You are redirected to GitHub only when you click "Sign in with GitHub". After you authorise it, we receive your GitHub ID, username, display name, the address of your GitHub profile picture and your primary email address verified by GitHub. The profile picture is loaded from GitHub's servers when displayed. GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework. Legal basis: Article 6(1)(b) GDPR. You can unlink the account in your profile at any time.

11. Browser notifications

If you enable browser notifications, we store the delivery address generated by your browser. Delivery runs through your browser vendor's push service (for example Google, Mozilla or Apple). Content is encrypted under the Web Push standard; the push service sees the delivery address and time, not the content. Legal basis: your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw in your profile or browser at any time.

12. Notifications via Telegram

You can also receive your notifications through our Telegram bot. This is optional. As long as you do not link your account yourself, nothing about you is passed to Telegram.

To link your account we show you a one-time link. When you open it and start the bot, Telegram tells us your chat ID and the username you use there. Entering these details on our side is neither necessary nor possible; there is no field for it. We store the chat ID, the username, the time of linking, the notification types you selected and the language the bot speaks to you in. Of the one-time link itself we store only a hash, not the link. In our log files and in the administration view the chat ID only ever appears shortened.

From then on we send the text of each notification to that chat, for example a topic title and an excerpt of the post. The provider is the Telegram group (Telegram FZ-LLC, Dubai, United Arab Emirates, and Telegram Messenger Inc. respectively); details are available at telegram.org/privacy. This involves processing outside the European Union. Please note that conversations with a bot are not end-to-end encrypted on Telegram; Telegram receives the content of these messages.

Password resets, confirmations of your email address and two-factor codes are never sent via Telegram. Those stay with email, and there is no setting that changes this.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time: in your profile via “Disconnect”, or with the /stop command in the chat. In both cases we delete the data listed above. It is also deleted when you delete your account.

13. Two-factor sign-in

If you set up two-factor sign-in, we store the required secret key or your security key's public key, and backup codes (Article 6(1)(b) GDPR).

14. Link previews and content from other servers

If a post contains a link, our server retrieves the linked page's title, description and preview image; only our server's IP address is transmitted. Images or preview images hosted elsewhere may be loaded directly from those servers when displayed, which then receive your IP address. We have no influence over these servers. Legal basis: Article 6(1)(f) GDPR.

15. Translating posts

Signed-in users can have posts and topic titles machine-translated using the translate button. Translation takes place exclusively on our own server using the open-source software LibreTranslate; no data is sent to external translation services. We process the text of the post and the target language, which is taken from your chosen forum language or your browser's language setting. The translation is stored for up to 30 days so it does not have to be computed again, and is recreated after the post is edited. Chat messages are not translated. Legal basis: Article 6(1)(f) GDPR; our legitimate interest is communication within an international community.

16. Address previews from the explorer

If a post contains a valid AntiQua address, the forum links it to our own blockchain explorer at antiqua-blockchain.com. The link always includes the network parameter ?network=mainnet or ?network=testnet; the network is taken from the address’s Base58 raw bytes after decode, not from the visible text. When you open the preview (“spoiler”), our server fetches the balance and recent transactions from the API at api.antiqua-blockchain.com; only our server’s IP address is transmitted, not yours. The result is cached briefly so the explorer is not queried on every page view. Chat messages are not scanned.

Signed-in users may store up to five mainnet and five testnet addresses on their public profile. These addresses are visible to anyone who views the profile and can be copied or opened via the same explorer link with a fixed network parameter. Balances are not fetched automatically on the profile. We keep the entries until you remove them or delete your account. Administrators can switch post links and profile addresses off at any time. Legal basis: Article 6(1)(b) GDPR (profile features) and Article 6(1)(f) GDPR; our legitimate interest is making public blockchain data easy to verify in the community.

17. Protection against seed phrases, private keys and scams

To protect against theft of cryptocurrency, we automatically check whether posts (including titles, edits and posts in the approval queue) and chat messages contain a recovery phrase (“seed phrase” under AIP-39 or BIP-39) or a private key. This check runs on our server before saving; if something is detected, the content is not saved and you receive a notice. Likewise, at registration and when changing names we check whether a username or display name is confusingly similar to a team member. We store neither the checked content nor who was affected; at most we count the number of blocked attempts per type.

In chat, your browser also warns before you send. Valid seed phrases and post-quantum keys are still blocked by the server, even if the browser check is bypassed. Warnings about common scams in other people’s messages and posts are created only in your browser. For this, your browser downloads the public wordlists from our server.

Legal basis: Article 6(1)(f) GDPR; our legitimate interest is protecting our users from financial loss and impersonation. This does not involve an automated decision with legal effect under Article 22 GDPR; you can contact us at any time if a post or name was rejected in error.

18. Git portal (git.antiqua-blockchain.com)

At git.antiqua-blockchain.com we run a portal for the AntiQua source code using the open-source software Forgejo. It runs on the same server as this forum (section 3); this policy applies to it accordingly.

Visiting without an account: Public repositories can be viewed without signing in. This only creates the web server log files described in section 3, which are deleted after 30 days. Forgejo itself does not log page views with IP addresses.

Accounts: Registration is closed; accounts exist only for the team. We store the username, email address, the password as a hash, two-factor sign-in data where used, and sign-in sessions. Anyone signing in via OpenID is redirected to the OpenID provider of their choice, which learns about the sign-in.

Content: Repositories, issues, pull requests and comments are stored and are visible to everyone in public repositories. For technical reasons, Git commits contain the author's name and email address as set in their Git configuration; in public repositories these details are publicly visible.

Cookies and external services: The portal only sets strictly necessary cookies for signing in and protecting forms (CSRF), legal basis Section 25(2) no. 2 TDDDG. Fonts, avatars and all other files are loaded from our own server; there are no Gravatar requests, no fonts embedded from Google and no tracking services. The portal does not send emails.

Legal basis: Article 6(1)(f) GDPR – our legitimate interest is making the source code openly available – and Article 6(1)(b) GDPR for team accounts. We delete accounts and content on request; details that are already part of the Git history of a published repository can only be removed by rewriting that history.

19. Data export and deletion

You can export your data and delete your account in your account settings. For anything else, contact us at the email address above.

20. Automated checks

Registrations may be rejected automatically if reCAPTCHA or StopForumSpam classify them as likely automated. If you were rejected wrongly, write to us and we will review the case personally.

21. Your rights

You have the right of access (Article 15 GDPR), rectification (16), erasure (17), restriction of processing (18) and data portability (20). You may withdraw consent at any time with effect for the future (Article 7(3)).

Right to object: where we process data under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Article 21 GDPR).

You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the member state of your residence, place of work or the alleged infringement.

22. Minimum age

Use of the forum is permitted from the age of 16.

Last updated: 24 September 2026. We update this policy when the forum or the law changes. · Legal notice · Community guidelines