Privacy notice
Last updated: 6 November 2026
Controller and contact
The individual responsible for operating Takin is:
Cornelius Wichering
Am Heidbergstift 58
28717 Bremen
You can send privacy requests to info@takin.run or by post to the address above.
Website and connection data
Requests to the website and application involve processing, in particular, your IP address, the requested address and technical browser and connection data to deliver content and answer requests. The public website and application share a web origin; the Rauthy sign-in service is embedded from a separate sign-in origin.
The website checks for an existing Takin session even when the sign-in dialog is closed, and includes a frame that contacts the sign-in service. For an approved, signed-in account, it also loads your name, environment overview, Image titles and appearance preferences. Legal information remains readable without signing in.
Fonts and product images are served from the website itself. The public website does not embed analytics or advertising-tracking scripts.
Sign-in, access requests and accounts
Rauthy processes sign-in, including passwords or passkey registrations, verification and recovery. Account-related emails are also sent in these flows. The Takin application database does not receive your sign-in password from the sign-in service.
Takin stores the sign-in service identifier and its user identifier, verified email address, display name and a derived username for development environments. It also stores your access request, approval status, decision timestamps and, where applicable, the administrator account making the decision. Administrators can manage access requests and accounts. Approval may be manual or automatic under the configured rules, for example based on an email domain.
When you request access, Takin records your explicit acceptance of the Terms of Service and acknowledgment of this notice, with the accepted terms version and the acceptance time. This record is kept with your identity, request or account. New pending requests notify the administrator in the application and, unless the administrator turned it off, by email with your name and email address.
Notifications appear in the application. In Settings → Email notifications you choose which types are also emailed to your sign-in address: failed operations, changed limits, suspension and reinstatement; administrators additionally choose new access requests (on by default) and users blocked by a limit. These emails contain the affected environment, snapshot, Image or account names and a link to Takin. Administrators also receive a daily warning while environment storage is nearly full.
An account also has a role, status, resource limits, preferences, public SSH keys with labels and usage information, connected-app grants, workspace layout, notifications, and session and operation history. Private SSH keys are not sent to Takin for SSH authentication. Takin also records the most recent active use and inactivity warning/deletion deadlines for the retention policy below.
Cookies and browser storage
Takin uses storage for sign-in, your chosen appearance and resuming work:
__Host-takin-oidcbinds a sign-in attempt to your browser and is valid for ten minutes.__Host-takin-sessioncontains your Takin session identifier. The cookie lasts up to seven days; server-side authority ends after twelve hours without qualifying use or after seven days at the latest. Sign-out or revocation can end it sooner. Both sign-in cookies useSecure,HttpOnlyandSameSite=Lax.__Host-takin-deletionis a host-onlySecure,HttpOnly,SameSite=Strictcookie for confirming, following and retrying account deletion after ordinary sign-out. Its browser lifetime is up to one year; server-side authority ends when the deletion request expires. The anonymous completed receipt is removed after 24 hours.- Private previews under
takin-preview.linkuse the host-onlySecure,HttpOnly,SameSite=Laxcookie__Host-takin-previewfor the selected environment and port. Preview authority lasts at most twelve hours and can end earlier when the originating access is revoked or expires, the environment becomes unavailable, or Takin restarts. takin-appearanceremembers the light/dark choice for up to one year and is shared with the sign-in subdomain. Appearance is also stored astakin.appearancein local browser storage. Without a saved choice, the website follows your system setting.- The application stores language, color theme and some view preferences locally. Tab session storage holds, among other things, workspace identifiers and drafts or recovery information for operations.
The sign-in service also manages its own sign-in and security cookies; they are sent only over HTTPS and only to the sign-in service's own domain. Its session is separate from the Takin application session and ends after 90 minutes of inactivity, at the latest after 10 hours. The sign-in service keeps its sign-in and security events for 60 days. Local browser storage does not have a deletion period determined by cookie expiry; you can remove it through your browser. Doing so does not delete server-side accounts or environments.
Development environments and connected applications
Takin stores environment metadata and manages the associated VM disks, snapshots and Images. They can contain source code, files, credentials and personal data that you place there. Commands, file transfers, terminal and desktop connections process their respective content for the action you initiate. Preparation operations can store output and screenshots. Operation history and logs follow the retention periods below; preparation screenshots are deleted with their environment.
Private previews relay request addresses, request and response content, and the preview application's own cookies to the selected service inside your environment. Takin's sign-in and preview authentication cookies are not passed to that application.
You choose which data and programs to use in your environments. Installation and use can connect to package sources and external services you choose. If you process other people's data, you must have the necessary permissions and meet the applicable data-protection requirements.
MCP clients you connect through OAuth can access Takin data and functions within their token permissions, including files and command output. Further processing by those clients or AI services you use is also subject to their respective terms. You can revoke a connected client's grant in Takin; this does not delete copies the client has already stored.
Hosting, DNS and email recipients
Hosting in Germany
The website, application, PostgreSQL database, Rauthy sign-in service and development environments run on a dedicated server provided by Hetzner Online GmbH in Falkenstein, Germany (FSN1-DC2). The associated application, sign-in and environment data is therefore stored on infrastructure provided by Hetzner and transmitted over its network. Rauthy runs on that same server; no additional external identity-provider company is involved. The website is served through the web proxy running on that server.
A data-processing agreement under Art. 28 GDPR is in place with Hetzner. Under it, Hetzner processes the data only in the European Union or the European Economic Area. Hetzner publishes a privacy policy.
DNS resolution
The domain uses Namecheap, Inc.BasicDNS for its authoritative nameservers. During name resolution, that service receives DNS queries from the DNS resolvers in use, including the queried domain name and technical connection data for the request. This name resolution is distinct from processing sign-in credentials and environment content in Takin.
Email and international processing
Amazon Web Services EMEA SARL (Luxembourg) sends account and service emails through Amazon Simple Email Service in its Frankfurt region. It processes recipient email addresses, message contents including verification and recovery links, and delivery data. Open and click tracking is disabled; messages arrive unchanged. If a message bounces or the recipient reports it as spam, Amazon Simple Notification Service forwards a report with the affected address and message details to the info@takin.run mailbox. The address is then kept on a suppression list and no longer receives emails until it is removed.
Fastmail Pty Ltd (Australia) provides the info@takin.run mailbox. It processes the email addresses, contents and delivery data of messages to and from that mailbox. Cornelius Wichering alone handles the mailbox, without forwarding to additional support recipients.
Processing also takes place outside the EU, particularly in the US. AWS applies its data processing addendum with the EU Standard Contractual Clauses; further details are in the AWS privacy notice. For Fastmail, details and the published EU Standard Contractual Clauses are available in Fastmail's privacy policy and data protection agreement.
Security and correspondence
Takin processes technical error and security information to diagnose problems and protect the service. SSH connection logs include, in particular, source IP address, account and key identifiers, and environment and action information, rather than complete command contents. Application and sign-in logs are distinct from files and logs inside your VM.
The Caddy web proxy does not keep access logs, and structured request objects are removed from its error logs. Container logs are stored locally in the system journal with 14-day retention and daily rotation.
When you contact us by email or post, we process the contact details, content and correspondence needed to handle your request. Please initially send only the information needed to understand it, without passwords or private keys.
Purposes and legal bases
Where processing your access request and providing the use you request is necessary to take steps towards or perform a service agreement, the legal basis is Article 6(1)(b) GDPR. This also applies to related requests about that service relationship.
We process necessary data for technical delivery, securing sign-in and access, diagnosing failures and preventing abuse under Article 6(1)(f) GDPR. Our legitimate interest is a functioning service and protecting accounts, environments and infrastructure. We handle other general enquiries on the same basis, with the interest of answering your request.
Storage, deletion and independent copies
An expired cookie or suspended sign-in does not mean that your account is deleted. Takin cleans expired sign-in transactions and session records during sign-in flows and periodic cleanup. The periodic cleanup runs on startup and hourly in bounded batches:
- Rejected access requests and associated request-only records expire 30 days after rejection; undecided requests expire after 90 days.
- Completed operation history and logs, ended-session/connection history and notifications expire after 90 days.
- Deleted-resource history expires 90 days after confirmed deletion. Preparation screenshots are deleted with their environment. Minimal facts needed by a live resource or unresolved cleanup remain until those dependencies end.
After 12 months without active use, we email a warning and delete the account and its private resources 30 days later. Signing in, authorized HTTP/MCP actions or a successful SSH login keep the account active and cancel a pending warning. Background refreshes do not count as active use. The grace period starts only after successful sending of the warning. Suspended accounts and the last active administrator are not automatically deleted. Existing accounts start this inactivity period when the retention feature is introduced.
Takin keeps no backups beyond two short-lived copies: a database copy made before an upgrade is deleted once the upgrade has been verified, at the latest after seven days, and the sign-in service keeps its automatic local backup for one day.
In Settings → Data & privacy, you can download your Takin account records and sign-in provider data, or permanently delete your account. The download includes VM metadata, not VM disks or files; use scp or the file tools to copy VM files. Deletion requires a fresh sign-in and separate confirmation. It removes your environments, snapshots, credentials, account records and history, and sign-in account. Progress shows completed steps and offers retry if cleanup fails. Suspended users can open the restricted deletion flow from the sign-in page. The last Takin administrator cannot delete their account.
Published Images remain available with anonymous attribution. A capability-protected, anonymous completion receipt remains available for 24 hours. Operational logs and the short-lived copies described above follow their stated retention rather than being recalled by account deletion. For other access, portability or erasure requests, use the contact above; information to confirm your identity may be needed.
Deleting an environment or snapshot removes the corresponding native resource, not automatically its operation history or all metadata. Clones, published Images and environments created from them are independent copies. Deleting a source or retiring an Image does not recall those copies.
Your rights
Subject to the applicable legal requirements, your rights include access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you can object on grounds relating to your particular situation (Article 21 GDPR).
You can also complain to a data-protection supervisory authority, in particular where you habitually live, work, or where the alleged infringement took place (Article 77 GDPR). You do not have to contact us first.
Further operator information is in the legal notice.