Privacy policy
GPU Goblin processes as little personal data as it can. This page says which data, why, for how long, and how to exercise your rights under the General Data Protection Regulation (GDPR).
Controller
Nicolas Michel, publisher of GPU Goblin — contact@gpugoblin.com.
What is processed, and why
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Your e-mail address | Your account: sign-in codes, messages about the service | Performance of the service you request | Until you ask for the account to be deleted |
| Sign-in codes and sessions (stored hashed) | Signing you in | Performance of the service | Codes 15 minutes, sessions 12 hours |
| Your machines: name you gave, public key, state, tasks computed, credits | Running the grid and counting contributions | Performance of the service | As long as the account exists |
| Your machine’s public IP address and port | Sending tasks and sharing data between machines (visible to other authorized machines while sharing is on) | Performance of the service | While the machine is active |
| Researchers: address, laboratory, projects, data sent | Access review and computations | Performance of the service | As long as the account exists; computation data per the project’s settings |
| IP addresses in server logs | Security, abuse prevention | Legitimate interest | 14 days |
| E-mail opening: whether a message was opened, and when | Checking that e-mails arrive | Legitimate interest; without consent, as the CNIL allows for this measurement only | 3 months |
GPU Goblin does not sell or rent any data and shows no advertising. The site uses no tracking: no analytics, no third-party scripts, no advertising cookies. The e-mails contain a tracking image, explained below.
Cookies and local storage
The site sets no cookie. It keeps two things in your browser’s local storage: your choice of light or dark theme, and, if you sign in, your session, so that you stay signed in. Both are strictly necessary to what you asked for and are deleted when you sign out or clear your browser’s data.
E-mails
GPU Goblin’s e-mails, such as those with a sign-in code, contain a small invisible image. Your mail software loads it from Brevo’s servers when it shows the message: as with any image online, Brevo then receives your IP address and the name of your mail software, and records that the message was opened, and when. GPU Goblin uses this only to check that its e-mails arrive, as the CNIL’s recommendation allows, and for nothing else. Brevo keeps this information for 3 months.
To avoid it, block the loading of images in your mail software: the code stays readable, as it is part of the message’s text.
Who receives the data
- OVH SAS (France), which hosts the servers.
- Brevo (Sendinblue SAS) (France), which delivers the e-mails with sign-in codes and records when they are opened (see “E-mails”).
- Other contributors’ machines receive the data of the tasks they compute and, while sharing is on, the public address of the machines that share the same data.
No data is transferred outside the European Union by GPU Goblin itself.
Your rights
You may access, correct or delete your data, object to or restrict its processing, and ask for a copy of it: write to contact@gpugoblin.com. You may also lodge a complaint with the French data protection authority, the CNIL.
The French version of this policy is authoritative.
Updated 2026-10-08