Privacy Policy

Danger Room is self-hosted. Where your information lives—and who operates that service—depends on the instance you choose.

Effective November 1, 2026. This policy covers this public documentation website, the Danger Room software, and Hard Light for Android. Instance operators may provide additional policies for their deployments.

This public website

These pages provide information and installation links. They do not ask for your collection, device secret, or Metron account credentials or API tokens, and do not include application analytics, advertising trackers, or cookies. GitHub Pages hosts the site and may process technical request information, including IP addresses, under GitHub’s privacy statement. Download, Obtainium, source, and Metron links lead to separate services or apps with their own policies.

Your Danger Room instance

The instance stores comic and edition metadata, owned copies, Want List entries, reading status and dates, ratings, saved covers, and slideshow exclusions. SQLite holds application records and provider cache information. Covers are saved on the instance’s filesystem or in private S3 storage configured by its operator.

Danger Room uses no third-party data processors other than services explicitly configured by the instance operator, such as Metron for comic metadata and artwork or AWS for optional S3 image storage. Administrators of your instance, storage, and backups may be able to access these records. Each instance has one shared collection; it does not separate readers’ records into private accounts. Browser access has no sign-in, so the operator must restrict access to a trusted private network or Tailscale environment.

Metron and storage providers

The server sends searches and requested comic identifiers to Metron to obtain metadata and artwork. The Metron API token stays on the server. Danger Room uses read-only requests and does not update your Metron collection. Metron and artwork hosts receive server requests. If S3 is enabled, the storage provider processes stored covers and requests. Your hosting provider or reverse proxy may retain logs according to its configuration.

Hard Light and local settings

Hard Light communicates with your configured HTTPS instance and sends its device credential to authenticate requests. The server stores a hash of the device secret with its device record. Android saves connection credentials with Keystore-backed encryption and excludes them from backups and device transfers. Preferences, including slideshow settings, are retained per instance. Hard Light requires a live connection and does not maintain an offline cover library.

The current client does not include camera scanning or recognition SDKs, advertising, or analytics SDKs. Android, GitHub, your browser, and Obtainium may process information separately when you download, install, or update the app.

Cookies, retention, and deletion

Slideshow preferences may be stored locally in the browser or client. These support application behavior rather than advertising.

Records remain on the instance until removed or managed by its operator. Removing a copy does not automatically delete associated ratings or readings, and saved covers are deliberately retained after copy removal. Backups and S3 objects can outlive app changes. Ask your instance operator about access, complete deletion, logs, backups, and retention. Clearing app storage removes local configuration, not server records.

Questions and changes

For questions about your data, contact your instance operator. For software privacy questions, contact eric@erickolb.me. Report software issues through GitHub, without posting secrets or private collection data. Changes to this policy will appear here with an updated effective date.