Your account data
This is everything the Inco Extensions service stores about you.
- Account: your email address, your username, the time you signed up, whether and when you verified your email address, when you deleted the account if you did, your display name and bio if you add them, whether you have the Creator badge, and whether email notifications are on. Your password itself is never stored, only a salted PBKDF2-SHA256 hash of it. Accounts that are never verified are deleted after 7 days.
- Email codes: for verification and password resets we store a keyed hash of the 6-digit code (never the code itself), when it was made, when it expires and how many wrong tries were made. A code is deleted as soon as it is used or replaced, and expired codes are deleted automatically (codes last 15 minutes and stop working after 5 wrong tries). If you log in to an account that is scheduled for deletion, a one-time restore ticket is kept the same way for 15 minutes. The emails are sent through Proton Mail from [email protected].
- Sessions: a hash of each login token, with its start and expiry time. A session ends when you log out or after 7 days, and expired sessions are deleted automatically.
- Submissions: the name, description, version and homepage link you enter, the name and version from manifest.json, the zip's file name, size and SHA-256, the review status with any reason from the reviewer, and the zip file. The zip is deleted when a submission is rejected or removed; its details stay in your list until you delete your account.
- Abuse limits: to limit sign-ups, failed logins, emailed codes, uploads and follows, short records with a time and a SHA-256 hash of your IP address or email address (or your account number for uploads). They are deleted automatically once they are 24 hours old (cleanup runs every hour).
- Password check: when you choose a password, the first 5 characters of its SHA-1 hash are sent to the Have I Been Pwned service to check it against leaked passwords. The password itself is never sent.
- Public: your profile page shows your display name, username, bio, the month you joined, the Creator badge if you have it, your follower and following counts and lists, and your listed extensions. Your email address is never shown publicly; only the reviewer can see it.
- Follows: who you follow and when. Follows are hidden while an account is in its 14-day deletion period and removed when it is deleted for good.
- Notifications: when someone you follow lists an extension or a new version, we store a short notification for you. It is deleted once you have read it (at the next hourly cleanup), and after 90 days at most.
- Email notifications: off by default. If you turn them on below, you get at most one email a day about new notifications, and every email has a one-click unsubscribe link.
- In your browser: your login token in sessionStorage, gone when you log out or close the tab, and a flag that remembers if you closed the preview banner.
- Spam check: the log in, sign-up and password reset forms use Cloudflare Turnstile, which receives your IP address to run the check. Cloudflare also hosts this site and the service.
Not collected: there is no tracking or analytics on these pages, and the extensions service keeps no request logs.
Deleting your account: use the Delete account button on this page (log in first), or email [email protected]. Your account is locked and hidden right away: you are logged out everywhere, your listed extensions leave the catalog (a cached page can show them for up to a minute), and the email address can't be used for a new account. Deletion takes effect after 14 days. Until then you can log in and choose Restore. After that, your account, profile, sessions, email codes, follows (both ways), notifications, all your submissions with every stored zip, and the abuse-limit records tied to your email address or account are removed for good. Records keyed only by a hashed IP address aren't linked to your account and expire within 25 hours. Copies other people already downloaded stay on their computers.
