GOpenCDR privacy notice

What changed on 1 October 2026

On 1 October 2026, the accounts and the services GOpenCDR shares with GOpenCNR moved to GOpenCSR, the Gelhaus Open Community Services Registry at csr.gplatform.org. The controller is the same. This notice changed only where the move changed something:

• Your account moved to GOpenCSR, with its identifier unchanged, and so did your passkey records, sessions, roles, invitations, API keys, approval history and consent records, and the records of councils, seats, motions, elections, policies and abuse cases. GOpenCSR's privacy notice covers them.
• Your account is asked to accept GOpenCSR's terms and acceptable use policy, with at least six weeks' notice by email, as the general terms set out for a new version. GOpenCDR's terms go on governing your names.
• Registering a name needs your legal name and country, which GOpenCSR screens against the EU sanctions list and only Tier 0 sees.
• You sign in at csr.gplatform.org, and you sign changes to your names in the signing step there.
• Passkeys are enrolled again once, at csr.gplatform.org, by 31 October 2026.
• The transparency log moved. New entries go to the one log at csr.gplatform.org/tlog; GOpenCDR's own log ended with an entry pointing there and stays readable.
• Mail comes from cdr@gplatform.org for GOpenCDR and from csr@gplatform.org for your account, sent by our own mail server.
• Abuse reports go to abuse@gplatform.org and are handled in one case system for names and addresses.
• The transparency report is joint, for GOpenCDR, GOpenCNR and GOpenCSR, every six months.
• Privacy requests go to contact@gplatform.org.
• This notice now also says that sanctions holds are automated decisions within the meaning of Art. 22 GDPR, how long backups and error events are kept (90 days each), and how mail is kept.

The version before this one is kept in the document archive.

Who is responsible

The controller is Gelhaus Solutions, a sole proprietorship of Enno Gelhaus, Eichenwald 3, 49624 Löningen, Germany, reachable at contact@gplatform.org.

For names in a TLD that we host for a TLD operator, that operator is a joint controller with us for the registration data. The essence of that arrangement is published as the joint controller arrangement. You may exercise your rights against either of us, and we are the point of contact for both.

This notice covers what GOpenCDR itself processes. Your account, and what GOpenCDR shares with GOpenCNR, such as sign-in, councils, cases and the transparency log, are run by GOpenCSR and covered by GOpenCSR's privacy notice. The website around it is covered by the site's privacy policy.

The short version

• Your account is held by GOpenCSR, under the same controller and with its identifier unchanged. Registering a name needs your legal name and country for sanctions screening, which only Tier 0 sees, and no postal address or phone number.
• Passkeys are enrolled again once at csr.gplatform.org, by 31 October 2026.
• The audit log keeps your IP address for 90 days, and after that only a keyed hash that cannot be turned back into the address.
• Registrant data is kept for 12 months after an account or a domain ends, then deleted.
• RDAP shows your domain, not you. Everything about you in it is redacted.
• The public transparency log is permanent. GOpenCDR's entries now go to the one log at csr.gplatform.org/tlog, and GOpenCDR's own log stays readable. It names domain names, TLD strings and account identifiers, never an email address, a name or an IP address, and what it names cannot be erased.
• You sign in at csr.gplatform.org, whose one cookie is strictly necessary, so there is no consent banner.
• No trackers, no analytics, no advertising anywhere in GOpenCDR.
• The servers are in Germany. Error reports go to Sentry's EU data region with every category of personal data switched off.

Your account

Your account is held by GOpenCSR. Since 1 October 2026, GOpenCSR keeps the one account for GOpenCDR, GOpenCNR and GOpenCSR, and with it your passkey records, sessions, roles, invitations, API keys, approval history and consent records, and the records of councils, seats, motions, elections, policies and abuse cases. They moved there with their identifiers unchanged, and the controller is the same. What is stored, why and for how long is in GOpenCSR's privacy notice. Your account is asked to accept GOpenCSR's terms and acceptable use policy, with at least six weeks' notice by email, as the general terms set out for a new version. Roles that exist only in GOpenCDR, such as a TLD role, stay with GOpenCDR, together with who granted them.

Signing in. You sign in at csr.gplatform.org, for GOpenCDR as for the other services. GOpenCSR then passes GOpenCDR your account identifier, your email address, your display name if you set one, your roles, and how and when you signed in. GOpenCDR uses them to show you your names and to decide what you may do (Art. 6(1)(b) GDPR).

Passkeys are enrolled again once. A passkey is bound to the address it was made for. GOpenCDR's passkeys were made for cdr.gplatform.org, so they cannot sign in at csr.gplatform.org, and every account that has one enrols a new passkey there once, by 31 October 2026. Until then the old passkey keeps working. After that date it is refused: you recover the account with a one-time link to your verified email address, valid for 30 minutes, or with a recovery code, you enrol a new passkey, and the old one is removed. An account without a verified email address asks Tier 0 at contact@gplatform.org. Password sign-in keeps working for accounts without root roles.

Mail from GOpenCDR is plain text, sent from cdr@gplatform.org, and mail about your account comes from csr@gplatform.org. Both are sent by our own mail server (Stalwart), which runs in Germany on the same IONOS server as the services. They contain no tracking pixels and no links that identify who opened them, and you can reply to them. Neither the mail server's delivery log nor the mail in our shared mailboxes is deleted automatically; we delete it by hand once it is no longer needed, and what belongs to a case or an authority request follows the rules for those.

Your names

For each name you register we store the name and its TLD, its state and statuses, its nameservers and any glue addresses, its DS records, when it was created and last changed, and which account holds it. A TLD with a stricter registration policy may collect more, and its policy is where it tells you what and why.

Why. Registering and publishing a name is the service (Art. 6(1)(b) GDPR).

What becomes public. The name, its nameservers and its DS records are published in the TLD zone, because that is what makes a name resolve. RDAP answers for the name with its status, dates, nameservers and DNSSEC data, and marks everything about you as redacted, following RFC 9537. Who may see the redacted parts, and on what grounds, is set out in the registration data disclosure policy.

Legal name and country. When you first become a holder of resources, for example by registering your first name, you give your legal name and your country. GOpenCSR holds them and screens them against the EU consolidated financial sanctions list then and every day. Only Tier 0 sees them; they are never public and never in RDAP, and they are kept while you hold resources and 12 months after. GOpenCSR's privacy notice sets out how screening works and on what legal basis.

Signing. You sign each change to a name in the signing step at csr.gplatform.org, which shows what you are signing, with a passkey or, for automation, with a key registered under a passkey. The signed change is recorded in the transparency log.

The audit log

Every change writes an audit record: who acted (an account, an API key, a mirror or the system), what was done, to which object, whether it succeeded, a request identifier, and a keyed hash of the IP address it came from. The hash is an HMAC-SHA256 under a secret held in our key store. It can show that two events came from the same address, and it cannot be turned back into the address.

The raw IP address is kept apart and deleted after 90 days by a scheduled job that records what it deletes. After that, only the hash remains.

Audit records are never changed or deleted. They are the evidence of what happened to every name and every root change, and they are kept for as long as the registry exists. Once an account is erased, the records about it name only its identifier.

Signing in, signing up and requesting reset links now happen at GOpenCSR, which records and counts those attempts as its privacy notice describes.

Why. Security, defence against abuse, and accountability for every change (Art. 6(1)(f) GDPR).

Request logs

The web server and the API write one line for each request: the IP address, the time, the method and path, the status, how long it took, the user agent and a request identifier. Cookies and authorization headers are removed before anything is written, and application logs are built never to contain an email address or registrant data. Request logs are deleted after 14 days.

Why. Operating the service, finding faults and defending it against attacks (Art. 6(1)(f) GDPR).

The public transparency log

GOpenCDR's entries are now written to the one transparency log GOpenCSR keeps for GOpenCDR, GOpenCNR and GOpenCSR, at csr.gplatform.org/tlog. GOpenCDR's own log ended with a final entry pointing to it and stays served read-only; the first entry of the new log commits to the old log's final checkpoint. Both are append-only Merkle trees with signed checkpoints, and they record root changes, key events, policy changes, vetoes, abuse actions and role grants at the root; the new log also records every change to a name signed in the signing step, with its signature. Anyone can check that we never showed different histories to different people.

An entry holds identifiers only: the account identifiers of whoever holds a root role and of whoever proposed, signed or decided a change the log records, and the domain names and TLD strings an entry concerns. It never holds an email address, a name or an IP address.

It cannot be erased. Every checkpoint is signed over the whole log, so removing a single entry would invalidate every checkpoint after it and destroy the one thing the log exists to prove. We rely on Art. 6(1)(f) GDPR, the legitimate interest being a root anyone can verify, and we regard the integrity of an append-only public record as a compelling legitimate ground in the sense of Art. 21(1) GDPR. What we can do, and do when an account is erased, is delete the email address and credentials behind an identifier, so that nothing we hold connects it to a person any more.

Abuse reports and requests from authorities

Abuse reports go to abuse@gplatform.org or through the report form, and are handled in the one case system GOpenCSR keeps for names and addresses. Reports about names may also go to the address in the acceptable use policy, and for names the route that policy sets applies within the case system. When you report abuse, we process what you send, including your email address, to handle the report (Art. 6(1)(f) GDPR). We do not pass your identity to the registrant unless you agree or the law requires it. Abuse cases are kept for 12 months after they are closed, and GOpenCSR's privacy notice describes the case records.

Requests from courts and authorities are recorded with their legal basis and with what we disclosed (Art. 6(1)(c) GDPR), and counted in the joint transparency report for GOpenCDR, GOpenCNR and GOpenCSR, published every six months.

The public resolver

GOpenCDR runs a public resolver at dns.cdr.gplatform.org, over DNS over TLS and DNS over HTTPS.

• No query log by default. The resolver writes no log that links a query to the address it came from.
• Debugging is the only exception. When a fault has to be investigated, such logging can be switched on for as long as that takes, and anything it records is deleted within 24 hours.
• Statistics are aggregates. Query counts by TLD and response code and cache figures are kept, with minimum counts so that no single client stands out, and with no addresses in them.
• Rate limiting happens in memory. Counters per address protect against floods. They are never written to disk and are gone within minutes.
• Your address stays with us. The resolver sends no EDNS Client Subnet, so no other server learns your address or your network, and it minimises what it asks each server (QNAME minimisation), so each sees only the part of the name it needs. Encrypted queries and answers are padded, so their size says less about them.
• Names outside GOpenCDR are resolved through the IANA root, as any resolver does. The servers asked see the resolver's address, not yours.

Why. Providing the resolver you chose to use and keeping it working and safe (Art. 6(1)(f) GDPR).

Mirrors in GOpenCDR's default pool are bound to the same rule: no log that links queries to client addresses for longer than 24 hours, and then only for debugging. A mirror outside the default pool is run by its own operator, who is responsible for what it logs. Our authoritative nameservers answer resolvers rather than people and keep no per-query log, only aggregate counts.

Mirror operators

If you run a mirror, we also store its public addresses and host names, the public key of its agent, a hash of its enrolment token, and the results of every conformance check and probe of its public service, for as long as it is enrolled and 12 months after (Art. 6(1)(b) GDPR).

Councils

GOpenCDR's councils, seats, motions, elections and votes are now held and run by GOpenCSR, and GOpenCSR's privacy notice describes those records. If you hold or represent a seat on a GOpenCDR council, your name, the seat and the capacity you act in are published, and so are your votes, because recorded votes are how the councils are held to account (Art. 6(1)(f) GDPR). Ballots in elections are secret. The shared part of the governance charter, which binds GOpenCDR as it binds GOpenCNR and GOpenCSR, and GOpenCDR's governance charter, which is GOpenCDR's rider to it, set this out.

Your device

You sign in at csr.gplatform.org, and the one cookie it sets is described in GOpenCSR's privacy notice.

As long as GOpenCDR's own sign-in exists, it sets one cookie of its own, __Host-gocdr_session, and only when you sign in there. It carries a random token and nothing else. Script cannot read it, the browser sends it only over HTTPS and never with a request started by another site, and it ends with your session: after 7 days without use or 30 days at most, or for root and TLD roles after 30 minutes without use or 12 hours at most. When GOpenCDR's own sign-in is removed, this cookie goes with it.

Each of these cookies is strictly necessary to provide the service you asked for, so no consent is needed for it (Section 25(2) No. 2 TDDDG) and there is no banner. Nothing else is stored on or read from your device, and no GOpenCDR site or client carries analytics, trackers, advertising or fingerprinting.

Who else processes it

• IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, provides the server in Germany on which the portal, the API, the databases, the DNS servers and our own mail server (Stalwart) run.
• Sentry (Functional Software, Inc.), on its EU data region, receives error reports. It is configured to receive no user identifier, cookie, header, request body, query string or value of a local variable: an error report carries the exception, its stack trace, the route that failed and the request identifier. The data is stored in the EU. The company is based in the United States, so access from there cannot be ruled out, and it is covered by the EU standard contractual clauses in Sentry's data processing agreement. It is on Sentry's Team plan, and error events are kept for 90 days.

Our signing keys and encrypted backups are kept on our own hardware in Germany; backups are made every night to our Proxmox Backup Server there. GOpenCSR is not somebody else: it is our own service, under the same controller, and it holds your account and what GOpenCDR shares with GOpenCNR. Beyond that, registration data goes to the operator of the TLD it belongs to, and to courts and authorities only under the registration data disclosure policy. What is public is listed above.

How long

• Account data: held by GOpenCSR, while the account exists and 12 months after it is closed, as its privacy notice sets out. Then the email address and every credential are deleted.
• Your legal name and country, held by GOpenCSR: while you hold resources, and 12 months after.
• Registration data: while the registration exists, and 12 months after it ends.
• Raw IP addresses in the audit log: 90 days.
• Audit records: for as long as the registry exists, naming only an identifier once an account is erased.
• Request logs: 14 days.
• Idempotency records, which let a retried request return its first answer: 24 hours.
• Abuse cases, in GOpenCSR's case system: 12 months after they are closed.
• The transparency logs, GOpenCDR's own and the one at csr.gplatform.org/tlog: permanently.
• Resolver query logs: none by default, and debugging logs deleted within 24 hours.
• Mail in our shared mailboxes and the mail server's delivery log: not deleted automatically, but deleted by hand once no longer needed. Mail that belongs to a case or an authority request follows the rules for those.
• Error events at Sentry: 90 days.
• Backups: made every night to our Proxmox Backup Server and kept for 90 days. They are not edited, and are restored only to recover the service.

The 12 months cover abuse, transfer and dispute follow-up. Where a statutory retention period applies, such as for invoices, it applies instead.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). Write to the address above; an informal email is enough, and we answer within 30 days.

You have the right to lodge a complaint with a supervisory authority. Ours is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.

An email address is required to hold an account, and your legal name and country to register a name; without them, we cannot provide either. The one automated decision within the meaning of Art. 22 GDPR is a hold that a sanctions screening match places, which GOpenCSR makes: it is permitted under Art. 22(2)(a) and (b) GDPR, a person at Tier 0 reviews every match, and you have the right to obtain human intervention, to express your point of view and to contest the decision, as GOpenCSR's privacy notice sets out. Nothing else is decided about you automatically: locking an account for 15 minutes after five wrong passwords in a row is a security measure, not a decision about you.

Changes

This notice changes when GOpenCDR does. Every version is kept in the document archive.