r4fo Logo
r4fo

🔒 Privacy Policy

Last updated: July 18th, 2026

What data do I collect?

By default

  • I do not retain, share, or sell your data.
  • Requests are not logged by default. All logs have been disabled on both the webserver (OpenResty) and every service that is hosted. To investigate active abuse or diagnose a technical problem, logging may be enabled temporarily and only on the affected service. While enabled, it may capture request metadata such as IP address, user agent, and requested URL. Logging is disabled as soon as the issue is resolved. Any logs collected during the investigation are deleted immediately afterward and are never retained beyond the duration of the investigation.
  • I do not use any analytics, tracking, or browser fingerprinting
  • Cloudflare reverse proxy is disabled
  • All services are self-hosted on Oracle Cloud Infrastructure in the Netherlands, unless mentioned otherwise below. Network/BGP infrastructure does not process or proxy user requests.

All services adhere to this policy. Any exceptions are listed below.

Service-specific exceptions

redlib.r4fo.com
Cloudflare reverse proxy is enabled to protect against increased bot activity and abuse.

status.r4fo.com
Selfhosted on a VPS in Germany, provided by BreadByte.cloud.

How your data is processed

I use the following open-source security tools to protect my infrastructure from abuse and bots. Both process data entirely on my servers.

  • Go-Away — A proof-of-work challenge that runs in your browser to verify you are human. It uses several rules and signals to decide whether to allow, challenge or deny a request. No data is transmitted to third parties.

  • CrowdSec — Detects malicious traffic such as exploit attempts, scans, and brute-force attacks. All processing is done locally. When traffic is suspicious but not conclusively malicious, CrowdSec may present a captcha (a selfhosted Altcha widget) to verify you are human before allowing the request. Altcha is privacy-friendly and self-hosted on my server, it does not transmit any data to third parties. In cases of confirmed abuse, the offending IP address is reported to CrowdSec Cyber Threat Intelligence and AbuseIPDB to help protect other operators.

Third parties

  • All services are hosted on Oracle Cloud Infrastructure. Oracle Privacy Policy
  • The status page is hosted on BreadByte.cloud. BreadByte Privacy Policy
  • Cloudflare reverse proxy provides content delivery (CDN) and web application firewall (WAF) protection on subdomains where it is enabled. When active, Cloudflare may process and temporarily retain suspicious traffic, including IP address, user agent, and requested URL. Cloudflare Privacy Policy

Changes to this policy

This policy may be updated over time. Any change is reflected in the Last updated date above. Previous versions can be viewed via the Internet Archive.

Update July 18th, 2026: Switched to Go-Away
Update July 17th, 2026: Cloudflare Turnstile has been replaced with the Altcha.org selfhosted captcha widget