Privacy Policy
Effective Date: October 06, 2026
This Privacy Policy establishes how FSB Sentinel (“FSB”, “we”, “our”, or “us”) collects, processes, and protects user data and public telemetry under Regulation (EU) 2016/679 (General Data Protection Regulation / GDPR) and applicable international privacy frameworks. We operate under strict data-minimization architectures designed for zero plain-text credential persistence.
Data We Process & Authentication Architecture
FSB Sentinel eliminates local password collection entirely through federated authentication. We process data strictly within the following categories:
When authenticating via Discord, we receive your public Discord snowflake identifier (discord_id), display name, public avatar CDN pointer, and verified primary email address under the authorized identify email scope. We never receive, store, or process account passwords.
Public Twitter/X screen names (@username) voluntarily entered into tracking slots, accompanied exclusively by your authenticated Discord email address for automated state change alerts.
To deliver our free daily 5-minute preview quota without requiring registration, our security engine computes anonymized cryptographic hashes across masked network subnets (/24 IPv4 and /48 IPv6) and client entropy components (Sec-CH-UA, browser language, user agent). Raw IP addresses are scrubbed and never permanently stored.
Purpose & Legal Basis of Processing
Pursuant to GDPR Article 6(1)(b) (Performance of a Contract) and Article 6(1)(f) (Legitimate Interests), we process telemetric parameters to:
- Deliver real-time algorithmic visibility diagnostics (Search Ban, Search Suggestion Ban, Ghost Ban, and Reply Deboosting).
- Transmit automated visibility transition notifications via our transactional delivery provider (Brevo SMTP API) when monitored accounts encounter algorithmic status alterations.
- Prevent Denial of Service (DoS) conditions, scraper exhaustion, and automated botting through stateless token-bucket rate limiters (
15 requests/minuteper API endpoint).
Data Retention Schedules & Caching Lifecycle
All storage mechanisms adhere to deterministic eviction intervals:
| Telemetry Data Layer | Storage Location | Eviction Window |
|---|---|---|
| Diagnostic Profile Cache | Local Cache Storage | 5 Minutes (300s TTL) |
| Target Historical Points | Target Records Mesh | Rolling 48-slot Array |
| Active Channel Presence | Memory Presence Index | 25-Second Sliding TTL |
| Authenticated Session | Encrypted Disk Store | 14 Days Inactivity |
| Guest Quota Usage | Guest Telemetry Mesh | 72 Hours Max |
Third-Party Data Handshakes & Edge Relays
Our diagnostic pipeline interfaces with external infrastructure strictly via public endpoints:
- Public Twitter/X Telemetry: Read-only syndication and adaptive search APIs accessed via ephemeral token handshakes. No user credentials or personal identifiers are transmitted.
- Public Profile Mirrors: Outbound requests to FixTweet, VxTwitter, and official Discord CDN edge nodes to render verified badges, avatars, and tweet media variants.
- Transactional Dispatcher: Brevo SAS (France, EU-hosted) processes visibility alert emails under strict Standard Contractual Clauses (SCCs).
Client Storage & Cookie Declarations
We set no advertising, tracking, or marketing cookies of our own. To keep the service free, some pages show closable side banner ads served by a third-party ad network, which may set its own cookies under its own privacy policy. All first-party client storage serves strictly technical, functional requirements:
Cryptographically signed session cookie maintaining authenticated state across dashboard visits. (Secure, HttpOnly, SameSite=Lax).
HMAC-SHA256 identity-bound token preventing Cross-Site Request Forgery across mutating operations.
Random 32-character hexadecimal identifier to prevent guest abuse and enforce the daily 5-minute quota.
Persistent user preferences stored in localStorage for theme choice and haptic synthesizer audio muting.
Your Statutory Rights (GDPR Articles 15–22)
Under European privacy legislation, you hold uncompromised authority over your personal records:
- Right to Erasure (Article 17): Remove tracked targets directly via your dashboard console, or execute complete account removal by contacting system administration.
- Right to Access & Portability (Articles 15 & 20): Request full JSON archives of your tracked targets, alert recipients, and associated historical scores.
- Right to Rectification (Article 16): Modify alert delivery addresses or update tracking slots in real time.