Privacy
Short version: there is no account to create, so there is no profile of you to collect. The only data Freedback handles is the feedback you explicitly write and choose to publish.
What we collect
Nothing beyond what you actively submit: a rating, comment, tag, or issue report, attached to whatever you're giving feedback on (a URL, a product barcode, anything with a URI). That content is signed with a self-signed cryptographic key generated on your own device — the key itself is not an account and has no name or email attached. Only its public half is published, riding along with each thing you post as a verification key; Freedback never transmits the private half.
What we don't collect
No analytics, no trackers, no advertising identifiers, no device fingerprinting, no behavioral profiling. We don't ask for your name, email, or phone number, because publishing feedback never requires one. The mobile app and the web widgets don't phone home for anything other than the read/publish requests you trigger yourself (loading feedback for something you're looking at, or sending feedback you wrote).
Your key, your data
Your signing key is the only thing establishing that feedback is yours, and it lives under your control: export it, back it up, move it to another device, or rotate it, from the app or the widgets' identity tools. Because the key — not an account — is what makes an item yours, you can update or delete anything you published yourself, at any time, directly: a signed delete request is honored by the server, which erases the content and keeps only a content-free marker so the deletion itself can propagate to caches. See the project's right-to-erasure ADR if you want the exact mechanics.
Federation and caches
Freedback is a protocol, not a single service: other servers can host and query the same feedback (that's the point — an independent, non-siloed record of feedback about things, not a walled garden). A query can be cached by an aggregator for a short time for performance, but readers and caches are never owners of your data — only the identity that signed something can edit or erase it, and an erasure still reaches caches through the same tombstone mechanism.
Third parties
The demo servers linked from this site and from the mobile app run on ordinary infrastructure providers (for hosting), which see the same request metadata any web request generates (IP address, timestamps) — nothing beyond what's inherent to serving HTTP. We don't share, sell, or otherwise hand your feedback content to third parties beyond making it available through the protocol itself, which is the entire point of publishing it.