Privacy policy

Version: 14 October 2026.

This policy describes the personal data Dynjandi handles, why, who else handles it, how long it is kept, and your rights. It covers the website dynjandi.dev, the dashboard at app.dynjandi.dev and the image service at cdn.dynjandi.dev. It is written to meet the EU General Data Protection Regulation (GDPR) and the Icelandic Act 90/2018 on data protection.

1. Who is responsible

Controller: Baldur Páll Hólmgeirsson, Engjavegur 16, 400 Ísafjörður, Iceland, kennitala 030279-5309. Contact for privacy questions and requests: privacy@dynjandi.dev.

We act in two roles:

• Controller for the data of the people who use the dashboard and this website: accounts, sessions, billing, email, security and error reports. This policy is about that data.
• Processor for the images our customers upload and for the requests their visitors make for those images. The customer decides what is uploaded and why, and is the controller. If your data is in an image served through Dynjandi, contact the customer whose site shows it; we pass on requests that reach us. The data processing agreement governs this role and lists our sub-processors.

2. What we hold

Your account

Email address, a name (set to your email address for accounts created by self-signup), whether the address is verified, a hashed password, a role, a disabled flag, and creation and update times. For each sign-in session we store a session token, its expiry, the IP address and the user agent of the client that started it. A verification record holds the identifier and value for the emailed link, which stops working after one hour.

Rate-limit records

Sign-in, sign-up and verification-mail attempts are limited per client address. The limiter keeps one row per client IP address and endpoint with a counter and the time of the last request. The client address is the one Cloudflare reports. Rows older than the longest limit window, one hour, are pruned as the limiter runs.

Your workspace, projects and files

A workspace record (name, plan, billing status, caps, your Polar subscription identifier and the billing period), the memberships that link users to it, per-period usage counts, and your projects (name, optional custom hostname, a public key, a hash of the secret key, size and storage limits). For each file we store its identifier, content type, size in bytes, SHA-256 checksum, original file name if one was supplied, how it arrived, an optional focal point and the creation time.

Uploaded images

The uploaded original is stored in Cloudflare R2 under your workspace and project. Each variant rendered from it is stored in R2 as well and is also cached at Cloudflare's edge. Images are served to anyone who has the URL, and an original is served exactly as it was uploaded, including any metadata inside the file. Image content can itself contain personal data; the customer who uploads it is responsible for it, as described in section 1.

When a face-aware crop is requested, or a focal point is suggested for a file (from the dashboard, or by a request made with the project’s public key), the transform service runs a face detector over the image. It finds where faces are; it does not identify anyone. A suggested focal point is the centre of the faces it finds, or the most prominent area of the image if there are none. It goes back to whoever asked for it, and is stored only if they save it as the file’s focal point. The detector runs inside the service and sends the image nowhere else.

Billing

We do not receive card details. When you start checkout we send Polar your email address, your workspace identifier and your user identifier. Polar returns the subscription's status, product, period dates and whether it cancels at period end, which we copy to your workspace record. We keep one record per processed Polar webhook delivery (its id, type and time) to avoid processing a delivery twice.

Email

We send you a verification email on sign-up and, if you sign in before verifying, again. We also send usage notices to the members of a workspace when storage or new-variant usage reaches 80% and 100% of a cap. Mail is sent through Cloudflare Email Service. We record which notices were sent for a billing period, not the messages.

Beta feedback

If you take part in the beta, we keep what you tell us in the onboarding call and in the feedback you email to hello@dynjandi.dev, together with your name and email address. Calls are held on Google Meet, and we record a call only if everyone on it agrees.

Request and traffic data

For each request to the image service we write a usage data point to Cloudflare Workers Analytics Engine: workspace, project, file identifier, outcome, output format, bytes served and time taken. It contains no IP address. Cloudflare itself also processes the IP address and request metadata of every request in providing its network. The image service has Workers observability enabled, so Cloudflare keeps request logs for it. Cloudflare keeps these logs for up to seven days. They include the URL, method and headers of each request, so they contain the requester's IP address; Cloudflare redacts cookies and credential-like headers.

Cookies and browser storage

The dashboard sets a secure, HTTP-only session cookie, which it needs to keep you signed in. A session lasts up to seven days before it must be renewed. It also keeps your colour theme and whether the sidebar is open in your browser's local storage. It sets no advertising or analytics cookies and loads no analytics script. The sign-up page loads Cloudflare Turnstile to tell people from automated traffic. Turnstile reads signals such as the IP address, the TLS fingerprint and the user agent, and may set cookies that Cloudflare classifies as strictly necessary for bot protection. We rely on Art. 88 of the Icelandic Electronic Communications Act 70/2022, which allows technical storage for a legitimate purpose and with the user's knowledge, without separate consent.

Error reports

When a server or browser error occurs, a report is sent to Sentry: the error type, message and stack trace, page and runtime context (such as the browser, operating system and time zone), the browser's error-monitoring breadcrumbs (recent activity such as navigation, clicks, network requests and console messages gathered by the default integrations), and the request URL, method and headers collected by the server integration. The server-side reporters are configured not to collect request or response bodies or user information, and they leave out cookies and the headers that carry your IP address. Session replay, tracing, profiling and logs are not enabled, and the image service removes its public key header before sending. File identifiers can appear in reports from the image service. Sentry can also work out an approximate location, down to a city, from the IP address a report comes from. Sentry stores the reports in its EU region, in Frankfurt, and is set not to store IP addresses.

3. Why we use it, and on what legal basis

• Providing the service (creating your account, signing you in, running your workspace and projects, metering usage against your plan): performance of our contract with you, Art. 6(1)(b) GDPR.
• Billing (starting checkout with Polar and keeping your subscription status): performance of the contract, Art. 6(1)(b), and our legal obligation to keep accounting records, Art. 6(1)(c).
• Service email (verification and usage notices): performance of the contract, Art. 6(1)(b).
• Security and abuse prevention (session IP address and user agent, rate limiting, the Turnstile check, handling abuse reports): our legitimate interest in keeping the service secure and lawful, Art. 6(1)(f), and legal obligations where they apply.
• Error monitoring: our legitimate interest in finding and fixing faults, Art. 6(1)(f).
• Beta feedback: our legitimate interest in improving the service with the help of people who chose to take part, Art. 6(1)(f).

An email address and a password are required to create an account; without them we cannot provide the service. We do not use your data for advertising, we do not sell it, and we make no decision about you based solely on automated processing that has a legal or similarly significant effect.

4. Who else handles your data

• Cloudflare hosts every part of the service: Workers, D1 (accounts and records), R2 (images), KV (file ownership), Containers (image transforms and focal-point suggestions, which receive the image bytes), the edge cache, and Workers Analytics Engine.
• Cloudflare Turnstile checks that a sign-up is made by a person. The sign-up page loads a script from challenges.cloudflare.com, and the resulting token is verified with Cloudflare. Cloudflare is our processor for the check, and a controller when it uses the signals to improve its bot detection; it says it does not use them to identify, profile or target anyone.
• Cloudflare Email Service sends our email, so it receives your address and the message. It also receives email sent to our addresses and forwards it.
• Google: email sent to our addresses is forwarded to a Gmail mailbox, and beta calls are held on Google Meet. We use a personal Google account, for which Google offers no data processing agreement, so Google Ireland Limited handles this data as a separate controller under Google’s privacy policy.
• Polar (Polar Software, Inc.) sells the subscription as merchant of record and handles checkout, payment and the customer portal, as described under billing. For the payment data it collects from you directly, Polar's own privacy policy applies.
• Sentry receives the error reports described above.
• Uploadcare (ucarecdn.com): for a project with origin pull enabled, when an image is not stored with us the image service requests it from this host by file identifier. No account data is sent. It is a legacy image host.

We also disclose data to a court or an authority when the law requires it, and to a successor if the business is transferred.

5. Transfers outside the EEA

Cloudflare, Polar and Sentry are based in the United States and may process data outside the European Economic Area. Cloudflare and Sentry take part in the EU-US Data Privacy Framework, which the European Commission has found adequate, and their data processing agreements also provide for the Commission’s standard contractual clauses. Polar’s data processing addendum relies on the standard contractual clauses. Google handles beta mail and calls as a separate controller under its own privacy policy.

6. How long we keep it

• Account and workspace data: for as long as you have an account, and up to 30 days after you ask us to close it, or up to 60 days after your contract ends.
• Sessions, verification records and rate-limit records: until they expire, and no longer than 30 days after that.
• Uploaded images and file records: until you delete them, or up to 60 days after your contract ends.
• Billing records: for as long as accounting law requires.
• Error reports and request logs: for the retention period set with Sentry and Cloudflare.
• Abuse reports and our decisions on them: two years.
• Beta feedback: while the beta runs, and up to one year after it ends.
• Other email sent to our addresses: up to two years.

When you delete a file in the dashboard, its record, ownership entry, original and variants are removed and Cloudflare is asked to purge cached variants. Copies already held by browsers or other caches can remain for up to a year. A record deleted from our database can still be restored for 30 days afterwards, through our hosting provider’s point-in-time recovery; stored images are not backed up. If you ask us to delete your data sooner than the periods above, we do so without undue delay.

7. Security

Passwords and project secret keys are stored only as hashes. The session cookie is HTTP-only and is sent only over HTTPS. If a personal data breach is likely to put your rights at risk, we will tell you and the data protection authority as the GDPR requires.

8. Your rights

Under the GDPR you can ask for access to your data, correction, erasure, restriction and portability, and you can object to processing that is based on legitimate interests. Write to privacy@dynjandi.dev. We answer within one month; for a complex request the GDPR allows that to be extended by two more months, and we will tell you if we need that. We may ask you to confirm a request from the email address on your account.

9. Complaints

You can complain to a data protection authority. In Iceland that is Persónuvernd; you may also complain to the authority of the EEA country where you live or work.

10. Email and marketing

The only emails the service sends automatically are the verification email and the usage notices above. We also email you the notices that the terms and the data processing agreement call for, and, if you take part in the beta, about the programme. All of these are service messages, not marketing. We send no marketing email; if that ever changes, we will ask for your consent first or give you a way to opt out in every message, as Art. 94 of the Electronic Communications Act 70/2022 requires.

11. Children

The service is for businesses and professionals, and accounts are for adults. We do not knowingly create accounts for children.

12. Changes

We will publish any new version of this policy on this page with its date. If a change is material, we will also email the address on your account before it takes effect.