Privacy

Visual Project Manager, public demonstration instance. Last updated 19 August 2026.

This page describes what the demonstration instance at vpm-demo.duckdns.org does with data. It is short because the instance does little: it exists so that the application can be tried without installing it, and it collects nothing beyond what running it requires.

Who is responsible

Simone Acierno, as an individual, running this instance as a personal portfolio project. For anything on this page, including any of the requests described under Your rights, write to aciernosimone@gmail.com.

This is a shared sandbox

Four accounts exist and their password is published in the project's README, so everybody who signs in uses the same accounts as everybody else. Anything typed into the demonstration is visible to the next visitor until it is reset, which happens automatically several times a day and removes the whole plan along with anything added to it.

Please do not enter personal information, anybody's real contact details, or anything confidential. There is nothing here that could keep it private, and nothing here is meant to.

What is processed, and why

Sign-in
Authentication is handled by Keycloak, running on the same server. It sets cookies during sign-in that keep the session going, and the application holds the resulting tokens in the browser's session storage, which the browser discards when the tab is closed. Both are strictly necessary for signing in to work at all, which is why this page asks for no consent and shows no cookie banner: there is nothing here that profiles anybody, tracks anybody between sites, or advertises anything.
Server access log
The web server records each request with the IP address it came from, the address requested and the response. An IP address can identify a person, so it is worth naming: it is kept to look into faults and abuse, and it is deleted after seven days.
Failed sign-in attempts
Keycloak counts failed attempts per account, along with the address the last one came from, so that guessing a password repeatedly locks the account temporarily. This is a security measure and it is the reason published credentials are safe to publish.
What you type into the demonstration
Project and task names, notes and dates, stored in the application's database so the plan is there when you reload the page. This includes any email address entered in the members panel, which is a real feature of the application: it lets somebody be invited before they have an account. On this instance any address entered there is removed by the next reset along with everything else.

How long anything is kept

Who else is involved

The server is an Oracle Cloud Infrastructure virtual machine in Milan, Italy, so Oracle hosts the machine the data sits on. The domain name is provided by Duck DNS and the HTTPS certificate by Let's Encrypt; neither receives anything about visitors beyond what issuing a certificate for a name requires.

Nothing else is contacted. There is no analytics, no advertising, no social plugin, and no third-party font or script: the typeface is served from this server for exactly that reason. Opening this application does not put your browser in touch with anybody but this machine.

Your rights

Under the GDPR you may ask what is held about you, ask for it to be corrected or erased, object to it being processed, or ask for a copy. Write to the address above. Given how little is kept and for how long, the honest answer to most such requests is that it has already gone.

If you think something here is wrong, you may complain to the Italian supervisory authority, the Garante per la protezione dei dati personali.

The source

Everything described here is in the open, and the file that resets the data is the same one described above: github.com/ghiacciolodev/Visual-Project-Manager.

Back to the application