Last reviewed: 2 November 2026
This policy describes information handled by the Opossum CMS project website at ocms.tech. It covers the website, not every installation of the open-source software. Operators of other oCMS sites choose their own configuration and are responsible for their own data practices.
For privacy questions or requests, contact the project at webmaster@ocms.tech.
Jump to information you send, site statistics, providers, retention, or requests.
Information you choose to send
Public documentation and downloads can be read without creating an account or subscribing to a newsletter. If you email the project, the message includes your address, message content and any attachments you send. We use it to handle that correspondence. Do not send passwords, API keys, MFA recovery codes or database backups containing personal information.
Where an account is provided, account records include the email address, profile information and authentication data needed to operate it. Account security and administrative events can be logged. The public shared demo is a separate site; follow its notices and do not put private information into shared accounts.
Server requests and site statistics
Serving a request exposes information such as the requesting IP address, browser headers, requested URL, time and response status to the hosting and application infrastructure. Access and security logs help operate the site and investigate errors or abuse. URLs can appear in logs, so do not put secrets into a URL or search query.
First-party analytics is enabled. It records page visits, referrer information, browser/device categories and reading events. The documented implementation derives rotating visitor and session hashes instead of storing raw IP addresses in those analytics records. This is separate from infrastructure logs and does not mean that all site records are anonymous.
On article pages, the reading tracker can send the page path, scroll depth and time spent to this site's /analytics/read endpoint. First-party analytics does not use an analytics cookie or local storage. Optional Google Analytics is a separate system, described below.
Providers and external links
- Google Analytics 4
- The live site loads the Google tag and uses Consent Mode, with analytics storage denied by default. Your Klaro choice updates that storage signal. When storage is denied, Google can still receive limited cookieless measurement and consent signals. When allowed, analytics cookies and additional measurement can be used. See Google's Consent Mode explanation and Google's Privacy Policy.
- Klaro consent controls
- The site serves the consent interface and stores your choices in the
klarocookie. Use Cookie Settings in the footer to review or change them. See the Cookie Policy. - hCaptcha
- The protected login page loads hCaptcha. Its service processes browser and interaction information for verification and abuse prevention. Read hCaptcha's Privacy Policy. Contact the project if a challenge prevents access.
- Hosting and email
- Infrastructure used to serve the site and receive correspondence handles the request or message information needed for those services. Ask us about a specific record or provider if you need further details.
- GitHub, Fly.io and other websites
- Opening an external link sends your browser to another service. Its operator's privacy policy applies to that visit. GitHub issues are public, so do not include personal information or credentials in a report.
Some providers process information outside your country. Their linked privacy information describes their processing locations and arrangements. This page does not claim that every provider or transfer uses the same safeguards.
Retention and protection
Records have different retention rules. The first-party analytics configuration currently retains aggregate statistics for 365 days; its documented cleanup removes raw page-view records after seven days. Reading-event records have separate handling and are not covered by that seven-day page-view cleanup. Infrastructure logs, correspondence, account records and Google Analytics data are separate from those settings.
We do not promise that all data is automatically deleted after one common period, or immediately when consent changes. Contact us for the applicable retention information for a particular record. Backups can also retain information after it leaves the active system.
The site uses HTTPS and restricts administrative access. Protect your own account credentials and use the account security guide for MFA and recovery. These measures do not eliminate every security risk.
Your choices and requests
Use Cookie Settings to change optional analytics storage choices. You can also remove cookies through your browser. Changing those settings does not by itself erase earlier server records or information held by an external provider.
Email webmaster@ocms.tech to ask about access, correction, deletion, restriction or an objection concerning your information. Describe the request and relevant page or account; we may need to verify that the request concerns your data. Rights and any required response periods depend on the law that applies. You can also contact the relevant data-protection authority.
We use this contact for reports involving children's information too. Avoid putting private details into public issue trackers. The Cookie Policy, Accessibility Statement and Terms & Conditions provide related site information. This page's review date will change when its content is revised.