Data and privacy

Operator and contact

Owner/organization: BinPapa. Contact: support@binpapa.com.

Policy version: 2026-09-25.

Stored data

The service stores your username, password hash, public display name and bio, protected sessions, hashed recovery codes, favorites and notifications. It also stores submitted files, metadata, confirmations, reports, complaints and moderation history. A session cookie supports sign-in and request protection; the connection address is used for rate limiting.

If you add an email, the service stores the verified address, pending address, single-use token hashes and delivery queue. Your email is not published in your profile. When delivery is configured, Microsoft 365 processes the recipient address and transactional message. Email is used for address verification, account recovery and the optional account updates you select, not marketing. Verification links last up to 60 minutes and password-reset links up to 30 minutes from the request; a reset revokes sessions and recovery codes.

Download accounting stores the account ID, EEPROM SHA-256 and access time. The limit is 20 distinct EEPROMs in a rolling 24-hour window, shared by BIN, HEX, JSON and full byte previews. Repeats within that window do not use another slot. Expired accounting entries are cleaned up during subsequent download-access checks.

Email notices for moderation changes and request updates are off by default. You can enable each category separately in your account for your current verified address, and turn it off there. We store your choices, language and address binding; an address change requires fresh opt-in. Messages contain only a generic notice and account link, not files, response text or moderation reasons. These jobs expire after 7 days and are deleted on the next mail-worker run; cleanup is deferred while that worker is stopped or unavailable. They are not replayed from backups. Turning notices off cancels waiting mail, but a message already handed to the mail provider cannot be recalled. Past events are not mailed retroactively.

Missing-firmware requests store the model, vendor, hardware, description, status and moderator response. Only the requester and moderators can access them. Updates remain available in your account; a generic email notice is sent only when the corresponding preference is enabled. Do not include secrets or other people's personal data.

Public and private information

Approved files, public profile fields and reports are visible to others. Drafts and private provenance are available to their author and authorized moderators. Removing a serial number from the description does not remove it from BIN/HEX bytes. Inspect the files and do not publish credentials, customer addresses or other people's personal data.

Control and deletion

Your account page lets you edit your profile and password, replace recovery codes and delete your account after confirming your current password. Deletion revokes access, withdraws your submissions and reports, and pseudonymizes associated audit records. Identical bytes independently published by another author may remain. Contact the operator about archive records.

Retention, hosting and backups

Hosting: Hetzner; transactional email is processed by Microsoft 365. An encrypted independent backup is stored on the operator's Mac.

Retention: Account data, submissions, firmware requests and module-password suggestions are kept while the account exists or the material remains published. Account deletion withdraws the user's contributions and removes private account data; a pseudonymized account and moderation/audit trail may remain for integrity and abuse prevention, without an automatic expiry period. Expired sessions, verification/reset links and delivery jobs are removed during subsequent relevant operations. Download-quota entries older than the rolling 24-hour window are removed during subsequent download-access checks. This is not a promise that every expired record is physically removed at the instant its validity ends. Rights or privacy removal requests can be sent to support@binpapa.com. Previously downloaded third-party copies are outside the operator's control.

Backups: Completed server snapshots and encrypted Mac backup images are eligible for automatic deletion only when older than 14 full days and the safety checks pass. Missing connectivity, an unavailable Mac or a failed integrity check may delay cleanup. Incomplete, unrecognized, migration and rollback materials are excluded from automatic cleanup and require controlled manual review; there is no automatic expiry guarantee for those exceptions. Independent backup updates depend on Mac and network availability. Following a restore, deletions and publication restrictions must be reapplied before reopening. Backup creation may cause a short maintenance interruption; uninterrupted availability is not guaranteed.

After restoring an older backup, the operator must reapply deletions and publication restrictions before reopening the site. The operator does not control copies previously downloaded by others.

Private site analytics

We use first-party statistics, without analytics cookies or third-party trackers: page views, approximate daily visitors, registrations, searches, referrer sources, device categories and successful EEPROM download responses. A successful file response does not prove that a file was saved on your device.

A separate action summary counts searches, zero-result searches, registrations, email confirmations and download responses only since that summary was enabled. These are aggregate counts, not a sequence followed by the same people or a conversion rate. A first download means the first measured successful response for a pseudonymous visitor on a UTC day, not an account's first-ever download. These events contain no email address, account ID or tokens; earlier history is not reconstructed.

On the signup form we count an opening, the first field interaction and a fixed error category after a submission attempt. Measurement does not read or transmit field contents, email, password, username or error messages. Opening and start flags exist only in page memory; clearing a field can also count as a start. The server retains only daily aggregate counters for 90 days, with no link to a person or account. A separate daily keyed hash is used only for an abuse budget, not linked to other events; that budget is removed by the next cleanup after the UTC day changes. Repeat visits and attempts may be counted again, while browser and network restrictions can undercount events. These are not people or a conversion rate; past events are not reconstructed.

A first-party script estimates active time on public pages: only while the page is visible and focused, for up to 60 seconds after the latest interaction. It sends the page path without parameters, a sequence counter and cumulative active time to BinPapa. A temporary random page label is held only in tab memory, not cookies or browser storage; the server retains a daily keyed hash of it. Input text, pressed keys and pointer coordinates are not transmitted. Visits are approximately grouped by the daily identifier and considered complete after 30 minutes without activity. The span between first and last observations is different from active time. Network loss and browser restrictions may undercount these estimates; past visit durations are not reconstructed.

The full IP is processed only in memory to derive a pseudonymous identifier with a separate random secret for each UTC day. Analytics does not retain full IP addresses or raw browser user-agent strings. This identifier is not linked to your account or session cookie and changes daily: the same person may be counted on different days, while people sharing an address may be merged. Country is determined only with a local database when configured; otherwise it is unknown. IP addresses are not sent to an external geolocation service.

Country data uses DB-IP Country Lite under Creative Commons Attribution 4.0 (source: db-ip.com), with no modifications to the database records. Geolocation is approximate and may identify a VPN or proxy location rather than the person's location. The dashboard links to the data source and license.

Only allowed page paths and referrer hostnames are retained, without URL parameters. Search terms are length-limited and filtered; values resembling secrets, emails, addresses or long hashes are redacted. Do not enter personal or customer information in search. Private account page views, known bots, operational checks and signed-in administrator/moderator activity are excluded. Selected successful account actions, such as registration and email confirmation, are counted without account identifiers. Do Not Track and Global Privacy Control headers disable this collection.

Only administrators can read the dashboard. Detailed statistics expire after 90 days and are removed by the next automatic cleanup within one hour. Old daily secrets are removed by the next cleanup after the day changes. Server downtime defers cleanup until service resumes. The analytics database and its secrets are excluded from backups, so restoring the site may reset statistics. Collection starts when analytics is enabled; earlier visits are not reconstructed.

Account activity statistics — separate consent

This separate feature is off for existing and new accounts. In your account settings you can voluntarily allow future signed-in activity to be linked to your account to improve the catalog and understand member needs. Declining does not restrict search, downloads or other features. Earlier anonymous events, IPs and daily visitor identifiers are not used to reconstruct a personal history.

After consent, a separate store records your numeric account ID, timestamps, allowed public page paths, record views, filtered search terms and successful file responses with their record and format. A successful response does not prove that you saved a file. Full IPs, browser user-agent strings, URL parameters, passwords, tokens, private-page content and PapaAI conversations are not included. Known bots, staff roles, prefetch requests and requests carrying DNT/GPC are excluded.

Only administrators can read this history; account selection shows its username and current confirmed email. Turning the setting off stops collection and deletes your account history. Account deletion also removes this history. Detailed events expire after 90 days and are removed by the next hourly cleanup; downtime defers cleanup until service resumes. History and consent are excluded from backups, so collection for the account is off after a restore. This feature does not link your account to the site's anonymous statistics.

Ask PapaAI — an optional choice

When the operator enables the assistant, your separate consent before sending allows your question and limited metadata about matching modules to be sent to OpenAI. Do not enter passwords, emails, serial numbers, personal or customer data. The assistant does not attach file bytes, account details or the full archive. Ordinary search remains available without AI.

BinPapa does not save AI question or answer text in its usage ledger. That ledger contains a numeric account ID, timestamps and spending/reservation accounting to enforce limits. Entries older than 35 days are cleaned on the next AI request; cleanup is deferred while the assistant is unused or disabled. Historical backups follow the general backup retention policy. Account deletion ends access but does not erase costs already incurred.

Requests disable API Response storage, but this is not a promise that OpenAI retains no operational data: the provider's terms apply. AI answers can be wrong and do not establish hardware compatibility or testing. The assistant does not program devices or automatically download firmware.

Separate choices

Research, mailing lists and third-party analytics are not enabled automatically. Research collection requires a separate explanation and appropriate review. These rules do not claim legal compliance in every jurisdiction.