Your information.
Clear boundaries.

1. Who this covers

“Forkalope” refers to the project behind this website. The legal person or entity responsible for this site will be identified here before this draft becomes effective. An independent deployment may be run by a different operator with its own privacy notice. Using Forkalope software does not, by itself, make that operator part of a Forkalope-hosted service.

2. Visiting this website today

The current site presents information about Forkalope and its planned Flight School and network. Its own code does not set cookies, use browser storage, or include advertising or analytics scripts. Selecting a plan or following an interest link does not currently create an account or collect payment details through this site.

Delivering a website involves receiving technical information such as your IP address, requested page, timestamp, and browser information. Our hosting infrastructure may record access or security logs. Its exact logging and retention settings still need to be verified and will be described before this policy is finalized.

The landscape page loads some project icons from external websites. Those requests disclose your IP address and browser information to those providers and may include referrer information. Following an external link takes you to a service with its own privacy practices.

3. Flight School training data

Flight School is a simulated environment. Its servers, hostnames, providers, IP addresses, routes, credentials, incidents, telemetry, logs, and command output are fictional training state. A displayed address is not a real Forkalope host and is not used as a destination for real network traffic.

If a training experience records progress, it may associate an attempt with information such as a session identifier, selected exercise, commands entered, simulated actions, grader results, timestamps, and diagnostic events. The intended purposes are to provide the exercise, evaluate progress, troubleshoot the simulator, and improve the curriculum. Exact collection, access, and retention rules must be published before a persistent training account launches.

Do not enter passwords, private keys, API tokens, customer data, or other secrets into a preview terminal or exercise. Simulated SSH and network commands remain inside the virtual world; they are not sent to the real host that may happen to use a displayed address.

4. Information planned services would need

• Accounts and support: contact details, profile information, organization roles, training progress, and messages needed to run accounts and respond to requests.
• Repositories and collaboration: code, Git history, author names and emails, issues, reviews, files, and permissions needed to provide the features you choose.
• Operations and security: authentication events, usage, diagnostics, device or browser information, and security logs needed to maintain the service, investigate abuse, and recover from failures.
• Membership and business billing: selected plans, billing contact details, transaction references, and payment status. Stripe is the intended payment provider; checkout is not connected yet.
• Paid work: approved assignments, customer attribution, and payment or tax information needed if a separate partner or operator payout program launches.

The intended uses are providing the requested service, operating and securing it, billing, support, training evaluation, and meeting legal obligations. Any additional uses, providers, or required choices must be described before collection starts.

5. A shared network does not make private code public

Co-Sysop sponsorship would not grant access to other customers’ private repositories, credentials, or billing information. Stewardship dashboards should show appropriate node health and capacity information, with customer data kept out of public views.

A future recovery network may store authorized replicas on other approved nodes. Before enabling that for private data, we need to disclose the operators, locations, access arrangements, and applicable customer controls. An operator with administrative access to a server may have technical access to data processed there; a “private” repository label alone does not remove that trust requirement.

Independent Sysops may operate as service providers under an agreement or run a separate service. Their role and responsibility must be clear before a customer’s data is placed with them. Sponsoring a node is not consent to share unrelated customer data.

6. Sharing and public content

Planned sharing would be limited to providers needed to deliver the service, authorized collaborators and organization administrators, and disclosures required by law or necessary to address security or abuse. The final policy must identify provider categories and explain any processing across national borders.

Content you deliberately make public can be viewed, cloned, indexed, and independently copied. Removing it from a Forkalope service cannot recall copies already held by others.

7. Retention, security, and your choices

We intend to retain information only for the service purpose or an applicable legal requirement. Exact periods for website logs, training attempts, closed accounts, repositories, billing records, and backup copies remain to be set. Deletion from active storage and expiration from backups are separate processes.

The service should support appropriate access, correction, export, and deletion requests, subject to applicable law and necessary identity checks. The privacy contact and request procedure are not yet established. Organization-managed data may also require coordination with the organization’s administrator.

Replication supports recovery; it does not guarantee security or prevent every loss. Security controls and incident procedures must be verified for the actual deployment before we describe them as service commitments.