At a glance
| Cookies on this site | None. |
|---|---|
| Analytics, ads, trackers | None. No third-party scripts, fonts or embeds. |
| Stored in your browser | Your light/dark theme choice only, if you pick one (localStorage). |
| Server logs | Standard web access logs for security and debugging, kept up to 90 days. |
| Selling or sharing data | Never. |
Who runs this
Hager Homelab is a personal, non-commercial project run by Preston Hager (“we”, “us”) on hardware we own, in the United States. It isn't a business and has no customers, only invited members. This policy covers the public website at homelab.prestonhager.com and the member-only services of the lab. Sites and apps that other people host on the lab, and the separate blog, may have their own policies.
This website
The public pages are static files. When you load them, our web server writes a standard access log entry, as nearly every web server does:
- your IP address and the time of the request,
- the page or file requested, the response code and size,
- your browser's user-agent string and the referring page, if your browser sends one.
We use these logs only to keep the site running and to spot abuse. We don't combine them with other data to identify you, build profiles, or measure audiences.
If you choose a light or dark theme, your browser remembers the choice in localStorage. It never leaves your device; clear your site data to remove it. Links to GitHub, WireGuard and other projects take you to sites with their own privacy policies.
Member services
If you're invited, we hold the information needed to give you access and keep it secure:
| What | Why |
|---|---|
| Account: username, name, email, group memberships | To sign you in, decide what you can use, and send account emails (invites, password resets). |
| Credentials: a one-way hash of your password, your authenticator (TOTP) secret | To check that it's really you. We can't see your password. |
| Sign-in events: time, IP address, success or failure | To detect and block password-guessing and account takeover. |
| Linked Google account (optional): the email and ID Google returns | Only if you choose “Sign in with Google”, to match it to your existing account. |
| VPN devices: each device's public key, its assigned VPN address, last handshake time and traffic totals | To route your traffic to the lab and show you which devices are connected. We don't see or log the content of your traffic. |
Server sessions (if you have shell access): login and sudo events | Standard system audit trail. |
| Things you store: files, messages, media libraries, game worlds, wiki edits | That's the service. It's yours; we don't look through it except when needed to fix a problem, keep the lab secure or follow the law. |
The VPN only carries traffic headed for the lab. Your everyday browsing doesn't pass through it, so we never see it.
Security monitoring
To protect everyone on the lab, our network edge runs an intrusion-detection sensor and keeps system and DNS logs. These record connection metadata (addresses, ports, timing, and alerts for known attack patterns), not the content of encrypted traffic. Addresses with a bad public reputation may be blocked automatically. We use this data only for security and troubleshooting.
How long we keep it
| Data | Kept for |
|---|---|
| Web access logs | Up to 90 days, then rotated away |
| Security, system and DNS logs | Up to 30 days |
| Account, VPN devices, stored content | While you’re a member. Removed when you leave, except copies already in backups |
| Backups | Encrypted, taken nightly and kept on the lab’s own hardware: dailies for a week, weeklies for a month, monthlies for about six months |
Who else sees it
We don't sell, rent or trade personal data, and we don't share it for advertising. A few outside services are involved in running the lab:
- DNS provider: resolves our domain names. Your requests to this site go straight to our server, not through a proxy.
- Email provider: delivers account emails, so it handles your email address and the message.
- Google: only if you choose to link a Google account for sign-in.
- Certificate authority: issues our HTTPS certificates. It never sees visitor data.
We may disclose information if the law requires it, or if it's needed to protect the lab, its members or others from harm.
Your choices
- See or fix your data: your profile is editable in the account portal; for anything else, ask.
- Delete it: ask to leave and we'll remove your account, VPN devices and stored content.
- Take it with you: most apps let you export your own files and data; we're happy to help.
- Visitors: you can ask us to delete log entries tied to your IP address before they age out.
Depending on where you live, you may have further rights (for example under the GDPR or state privacy laws). Contact us and we'll honor them.
Children
The public site isn’t aimed at children and collects nothing beyond access logs from anyone. Accounts for children are only created at a parent or guardian’s request, and the parent or guardian can review or delete them at any time.
Changes
If we change this policy, we'll update the date at the top. The full history of this page is public in the repository. Members will be told about significant changes directly.
Contact
Members: contact the admin the usual way. Everyone else: reach Preston Hager through GitHub or prestonhager.com. Please don't put personal details in a public GitHub issue.