Privacy

Last updated: 20 October 2026

1. Who runs this site

deb.griffo.io, deb-free.griffo.io and the apt repositories behind them are run by Dario Griffo ("I", "me"). Questions and requests about your data can be raised via GitHub or the project Discord community.

2. Analytics

Google Analytics. Pages on deb.griffo.io and deb-free.griffo.io use Google Analytics 4, a service of Google Ireland Limited (Google LLC outside the EEA, the UK and Switzerland). It sets first-party cookies, _ga and _ga_<id>, which Google keeps for up to two years, so that it can tell a returning browser from a new one. With them it counts visits and the pages viewed, where visitors come from (including utm_ campaign tags), the device, browser and approximate location, and a few actions: opening the free-trial form, starting a trial and going to checkout (with the plan and its price). I use it to see which pages help people and to measure trial sign-ups and checkout clicks, including those that come from advertising. According to Google, Google Analytics 4 does not log or store IP addresses. Google processes the data under its own privacy policy, and it may be transferred to servers outside your country, including the United States.

You can opt out of Google Analytics with Google's opt-out browser add-on. Blocking cookies for this site, or using an ad or tracker blocker, opts you out as well; the site works the same either way.

ttics. Page views are also counted by ttics, a small analytics service I run myself, on our own server. It sets no cookies and stores nothing on your device, and no third party receives its data. When a page loads, your browser sends it the page's address and a few facts about the visit. From those it records:

• the page you visited (its path, without the query string);
• the host of the site that linked you here, never the full address;
• the utm_ campaign tags in the address, when there are any (they mark a visit that came from an ad or a newsletter);
• the page's language;
• a device class (mobile, tablet or desktop), worked out from the width of the window;
• the browser and operating system family, such as Firefox on Linux, without versions;
• a few actions: opening the free-trial form, starting a trial and going to checkout;
• a daily visitor hash, explained below.

The visitor hash is a SHA-256 of a random value that changes every day (the daily salt), your IP address, your browser's User-Agent and the site's host name. It lets the service count how many different people visited on a given day. Each salt is deleted after two days, after which the hash cannot be recomputed from an address, and a new day's hash never matches an old one, so you cannot be recognised across days. Your IP address and full User-Agent are never stored; they are only fed into that hash. Obvious bots and crawlers are dropped before anything is recorded.

I use these numbers to see which pages help people find what they need and whether advertising for the site works: a visit that arrives with campaign tags is credited with the trials and checkouts started that same day.

Ahrefs Web Analytics. Pages on deb.griffo.io also load Ahrefs Web Analytics, a cookieless service from Ahrefs that reports page statistics in aggregate.

3. Free trial

To start a trial you enter an email address. The form is protected by Cloudflare Turnstile, whose script is fetched only when you open the form, so a visit that never opens it never loads it. To check the answer, the server passes it to Cloudflare along with your IP address. The repository stores your email address, and uses it to send your credentials, a reminder before the trial ends and other messages about your access. Your IP address is also used, in memory only, to allow one trial request per address per day.

4. Payments

Payments are processed by Stripe. Card details go to Stripe and never reach this site or its servers; your use of Stripe is subject to Stripe's own terms and privacy policy. The repository keeps your email address, Stripe's references for you and your subscription, the plan, its status and its dates. A purchase is linked to an earlier trial by that email address, so I can tell how many trials turn into subscriptions. The address receives your credentials and messages about your subscription, including one request for a review a couple of days after it starts.

5. Repository access and server logs

apt authenticates with your login (your email address) and a password generated for you, which is stored only as a bcrypt hash. Like any web server, the servers behind the site and the repository log requests, including the IP address, the user agent and the file requested, to keep the service running and to prevent abuse. ttics is the exception: its log leaves out the address, the user agent and the referrer.

6. Cookies and browser storage

The only cookies on this site are Google Analytics' _ga and _ga_<id>, described in section 2; you can block them in your browser without losing anything on the site. ttics and Ahrefs write nothing to your browser. The one other thing the site itself may keep there is a preference: if you switch the install commands between sudo, root and extrepo, your choice is saved in your browser's local storage as deb-griffo-install-variant so the next page shows the same form. It never leaves your browser, and clearing your site data removes it. Cloudflare Turnstile (only when you open the trial form) and Stripe (only when you go to checkout) are run by those companies under their own policies.

7. Your rights

• Ask what is held about you, or have it corrected or deleted, via GitHub or the Discord community. GitHub issues are public, so do not post your email address there; say you have a privacy request and it can continue privately. Deleting your account ends your repository access.
• ttics cannot be traced back to you. It holds no name, email, IP address or cookie, and the daily hash cannot be linked to a person once its salt is gone, so there is nothing in it to look up or delete for one visitor.
• Opt out of Google Analytics at any time with Google's opt-out add-on, by blocking its cookies, or with an ad blocker. Deleting the _ga cookies from your browser starts you over as a new visitor.
• You can complain to your data protection authority if you think your data has been mishandled.

8. Changes

If this page changes, the new version is posted here with an updated date.