bank.hacktivism.ch · privacy · CH

Privacy notice · GOA Exploration Bank

This notice describes personal data processing for the self-hosted bank at bank.hacktivism.ch under the Swiss Federal Act on Data Protection (FADP / revDSG, in force since 1 Sep 2023). It is an explorational service, not a licensed Swiss bank.

1. Controller

Operators of the hacktivism.ch GNU Taler stack (GOA exploration deployment). Contact via the operational channels published for this host. No separate DPO is appointed for this experimental service.

2. Categories of data retained

Data	Examples	Typical retention
Account identifiers	Username, account serial, registration timestamp	For account lifetime + up to 12 months after deletion or archive wipe
Authentication secrets	Password hashes / tokens (not plaintext passwords)	While account exists; tokens until expiry or revoke
Ledger / transactions	Credits, debits, amounts (GOA), subjects, counterparty account names, timestamps	Operational retention for the service lifetime; may be wiped on stack reset
Balances & limits	Account balance, debt limit, conversion flags	While account exists
Withdrawal operations	Withdrawal IDs, amounts, status (pending/selected/confirmed), reserve pub when known	Until completed/aborted + short operational logs (days–weeks)
Technical logs	HTTP access logs (IP, User-Agent, path, status), application logs	Typically days to a few weeks (rotation); not used for marketing
Landing / demo artefacts	Public `stats.json` aggregates, demo withdraw URI state	Stats overwritten continuously; demo URI until used or rotated

Not retained as payment content: wallet coin private keys (never sent to the bank). Full browser history or device contacts are not collected by this bank service.

3. Purposes

Operating bank accounts and GOA transfers for exploration of GNU Taler
Authenticating users and preventing abuse
Enabling withdrawals to the GOA exchange
Security, debugging, and capacity monitoring

4. Legal basis (Swiss FADP)

Processing is necessary to provide the service requested by the user (account / withdraw) and for overriding private interests of secure operation of an experimental public stack (Art. 6 and 31 FADP principles: lawfulness, proportionality, purpose limitation).

5. Recipients & transfers

GOA exchange (exchange.hacktivism.ch): reserve/wire-related data required by the protocol
Infrastructure operators of this host (hosting, backups) under operational control
No sale of personal data. No intentional transfer outside Switzerland/EEA for this service; infrastructure may use standard CDN/DNS resolvers

6. Your rights (FADP)

Subject to legal limits: right to information/access, rectification, deletion, and to object to processing. Contact the operators. You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB).

7. Security

TLS in transit; access control on bank API; experimental service — no certified ISMS. Do not store sensitive personal data in transaction subjects.