Privacy notice

Draft, pending legal review. Version 0.2, 8 November 2026.

This notice is for people who visit damage-analysis.com or use the Damage Analysis app. It says what we collect, why, who else handles it, and what you can ask of us.

1. Who is responsible

Damage Analysis is run by David Stekly, a sole trader in Fairy Meadow, New South Wales, Australia (ABN 13 648 736 212). Write to hello@dareakt.com.

For your account and for visits to the site, David Stekly is the person responsible for your personal data (the controller).

Projects and photos you put into the app can hold other people's data: your client, the inspectors, a location, notes, and anything a photo shows. For that data your organisation is the controller and we act for it (the processor). The terms of that processing are in section 6 of our terms at damage-analysis.com/legal/terms.

2. Visiting the site

You can read damage-analysis.com without an account. This is what happens when you do.

No cookie from reading the pages. When we checked on 8 November 2026, the home page, the sign-up page and the sign-in page set no cookie for a visitor who was not signed in.
Nothing from other companies. The pages load no script, font, image or frame from another company's server.
Visit statistics. The site and the app count visits with a small script from our own server. It honours Do Not Track, sets no cookie, stores nothing in your browser's storage, and makes a new random id for each page load. We store the site, that id, a daily visitor code, the referring page, campaign tags, device, browser, language, operating system, time zone, connection type, timings and country, and also the pages opened, clicks on marked elements, links to other sites that you follow, and script errors (message, file and line). We do not store your IP address or your browser string. The daily visitor code is made from that day's secret value, the site, your IP address and your browser string. The secret is not in our code. It is kept on our server and in our encrypted backup copies. We do not call the code irreversible, and we treat it as personal data.
Server logs. Our web server logs requests: your IP address, the time, the page asked for, the answer, the referring page and your browser string. Logs are rotated daily and 14 are kept, so about 14 days. Some parts of the site log nothing.
Security records. To spot and stop attacks we keep sign-in and security records, browser security reports, behaviour profiles of IP addresses and some full request captures. Some hold your IP address. Section 9 gives each one's retention time.
CrowdSec. An address that triggers one of our attack rules is sent to CrowdSec with the name and version of the rule, the time, how many requests matched, the address range, the network, operator, country and approximate location looked up for the address, the block we applied, and the ID of our server at CrowdSec. No log lines, page content or account details are sent. CrowdSec may put such addresses on the blocklist it shares with its other users.

3. Your account

To sign up you give your name, email address and a password. An account holds:

your name and email address
a password hash, never the password itself
your plan, your roles and your settings
records of your passkeys and the secret of an authenticator app, if you use them (the secret is stored encrypted)
when the account was created and last changed

When you sign in we set the sign-in cookie da_auth. It is a signed token that page scripts cannot read (httpOnly), with SameSite lax. A remembered session lasts at most 30 days idle and 90 days in all.

The app also keeps things in your own browser, for example: interface preferences such as your light or dark choice and the position and layout of panels (localStorage), a short log of recent uploads (localStorage), a marker that stops the app reloading in a loop (sessionStorage), a cookie named da_site that tells the app which screen to open after you sign in, and photos you take offline, which wait in the browser (IndexedDB) until they upload. We set no cookie for tracking or advertising.

4. Projects and photos

The app is for recording inspections. What you put into it:

Projects: name, location, client, inspector, date, notes, who created the project and who works on it.
Photos: the photo, its location, inspector, notes, inspection and damage details, severity, weather and a SHA-256 fingerprint. When you capture in the app it can add your device's GPS position, if your browser allows it, and details of the device and its orientation.
Measurement records: each measurement and change is hash-chained, and our server signs checkpoints of that chain with its Ed25519 key, so anyone can check later that a record has not changed.

Photos are re-encoded when they upload, and the stored copy keeps no embedded camera data: the photos stored on 8 November 2026 carry no EXIF block. The GPS position, if any, is kept with the photo's record.

Photos are kept on our server's disk in Helsinki, Finland. They are not encrypted there, and they are not in our backup copies. The measurements and markings you make on a photo are stored encrypted (AES-256-GCM) for photos added since we turned that on; those of older photos are stored plain. The photo details in the list above, including any GPS position, are stored plain.

Detection, crack tracing and text reading run in your browser. The app sends no photo to an outside AI service, and calls no outside service at all.

A project's photos can be seen only by the person who created the project, the people invited to it, and our administrator.

Connections are encrypted (TLS 1.3). The disks of our server are not encrypted.

5. Mail

We send mail about your account, such as a password reset or a sign-in link, and an invitation when someone invites you to their organisation. It goes out through our own mail server under the name Damage Analysis. That server's logs (mailbox sign-ins with IP address, sender and recipient addresses) are kept for 30 days, then deleted.

6. Why we use your data

The law (GDPR Article 6) requires a reason for each use. Ours are:

To run your account and the app: it is needed for the agreement with you (Article 6(1)(b)).
Projects and photos: we process them for your organisation, on its instructions (Article 28). Your organisation, as the controller, has the reason for them.
To keep the service secure and to know how it is used: our legitimate interests (Article 6(1)(f)). This covers server logs, security records, blocking attack addresses and visit statistics. You may object (section 10).

7. Who else handles it, and moving data outside the EU

These companies handle some of the data for us:

Provider	What for	Which personal data	Where
Hetzner (company in Germany)	Our server, and the separate machine that runs our mail server	Everything we hold on our server: accounts, projects, photos, logs and mail	Helsinki, Finland
Hetzner, a Hetzner Storage Box	Our backup copies	Backup copies of our databases, including accounts and project records (not the photo files)	Helsinki, Finland
Anthropic (company in the United States)	Claude Code, the AI coding assistant we use to build and operate the service. Claude Code sessions run by our operator read production data on our server over ssh.	What those sessions read on our server, which can include personal data from our databases and files. It is sent to Anthropic's service.	Company in the United States; we have not checked where its service holds data
CrowdSec (company in France)	Blocking of attacking addresses	IP addresses that trigger an attack rule, with the details in section 2	Company in France; we have not checked where its service holds data
deSEC (organisation in Germany)	Name servers (DNS) for damage-analysis.com	DNS records only, no personal data	Germany; we have not checked where its servers are
Let's Encrypt (organisation in the United States)	Certificates, so that connections are encrypted	Domain names only	United States; we have not checked where it holds data

We do not sell your data or use it for advertising.

Anthropic is outside the EU and the EEA, and Damage Analysis is run from Australia. Under Chapter V of the GDPR, sending personal data outside the EU needs a legal safeguard. For Anthropic and for access from Australia we have not yet put one in place. This part of the notice is under legal review.

8. Backups

Our databases are copied every night (3 copies kept), and the Storage Box keeps 20 daily snapshots. Each new backup copy we make on our own server since 6 November 2026 is encrypted as it is written, to a key that is not kept on any of our servers. Older copies made before then are still plain until they are removed. Photo files are not backed up, so keep your own copies of anything you cannot lose. After we delete data, its last backup copy is gone within about 50 days.

9. How long we keep it

Record	What it holds	How long
Web server log	IP address, time, request, status, referrer, browser string	About 14 days (rotated daily, 14 kept). Some parts of the site log nothing.
Web server error log	Server errors, which can name the IP address that caused them	About 14 days.
Engine logs	Logs from the service's own engine, for example a sign-in with a partly hidden email address	About 14 days (rotated daily, 14 kept).
Visit statistics, raw rows	Items listed in section 2; no IP address or browser string	90 days.
Visit statistics, daily totals	Totals made from the raw rows	1 year.
Sign-in and security events	Event, IP address, browser string	90 days.
Sign-in lockouts	A temporary block after failed attempts	1 day.
Browser security reports	Reports from your browser; browser string cut to 200 characters	30 days.
Behaviour profile of an address	How an IP address has behaved on our server	30 days after the address was last seen.
Full request captures	Taken only for high or critical threat detections, at most 5 per address per day	50 days.
Temporary bans (fail2ban)	Addresses banned for repeated failures	The ban database is purged after 1 day.
Threat record of an address	IP address, rough location, score, first and last seen, whether blocked	Removed 90 days after the last time we saw the address or ended a block on it. While the address is blocked the record stays. A block ends after 14 days with no new attack from it, or sooner. An address we marked as trusted is kept with no time limit.
Mail server log	Mailbox sign-ins with IP address, sender and recipient addresses	30 days, then deleted.
Administrator actions	When our administrator acts on an account (for example signing in as you to fix a problem): the administrator's email, IP address and browser string	No time limit is set yet.
Your account	Items listed in section 3	Until you or we delete it.
Projects and photos	Items listed in section 4	Until you delete them. Deleting a project deletes its photos. Deleting your account does not delete them (section 10).

10. Your rights

You have these rights over your personal data:

Access (Article 15): ask what we hold about you and get a copy.
Correction (Article 16): ask us to fix data that is wrong.
Deletion (Article 17): you can delete photos and projects in the app. To delete your account, write to us. When we ask you to accept these terms, that screen may also let you delete your account yourself with your password. Deleting an account removes the account, its passkeys and its sessions. It does not by itself delete its projects and photos, so tell us if you want those gone too.
Export (Article 20): the app lets you download a project's report and a measurement session as JSON files. Ask us by email for anything else.
Restriction (Article 18): ask us to limit use of your data, for example while we check a correction or an objection.
Objection (Article 21): object to use that rests on our legitimate interests.
Complaint (Article 77): complain to the data protection authority in your country.

You need to give your name, email address and a password for an account. Without them we cannot run it. Nothing else is required.

For projects and photos your organisation is the controller, so people in them should ask your organisation. If they ask us, we pass the request to your organisation promptly.

Write to hello@dareakt.com. We answer within one month. For a complex request we may extend that by up to two further months, and we will tell you why. We may ask you to prove who you are. We do not charge for this.

11. Changes to this notice

We may change this notice. Each version shows its date and version number at the top. When we change it, we change the date and the number.