Stored by your installation
- Organization settings, accounts, roster, meetings, attendance, corrections, reports, and audit records, in your D1 database
- Data for any plugins you turn on, such as outreach hours or carpool addresses, in the same database
- Encrypted integration credentials; saved values are never displayed again
- On each kiosk: its pairing, the links between members and fingerprints, badges, or QR codes, a cache of active members, and scans waiting to be sent
- Fingerprint templates inside the R503 reader where they were enrolled, unless an Admin turns on cloud storage
Not collected or shared
- No usage data is sent to the LancerLogin project or anyone else
- Raw fingerprint images are never captured or uploaded
- Raw badge and QR values never leave the kiosk; it keeps only keyed digests
- Network addresses are not stored; sign-in rate limits keep only a keyed hash for a day
Integrations you turn on send only what they need: Google Calendar and Discord receive meeting titles, notes, and times; Resend and Discord deliver the messages you configure.
Optional fingerprint cloud storage
Fingerprint cloud storage is off by default and only an Admin can turn it on, in Settings › Modules › Attendance › Fingerprint sharing. Get your organization's permission first: fingerprint templates are biometric data.
When it is on, new enrollments upload to your installation, where the server manages a separate 32-byte encryption key and can decrypt templates for authorized paired kiosks. This is not end-to-end private from the server. Templates are briefly in memory while they are encrypted or delivered, and are not intentionally stored in plain form in D1, files, or logs. New kiosks can receive enrollments even while every earlier kiosk is offline.
Only enrollments made while a kiosk is online carry a verified link to the member. Older or offline enrollments require re-enrollment before sharing. Unknown reader slots are never read or overwritten.
Cloud copies are deleted when the member is made inactive or their member ID changes, when cloud storage or Attendance is turned off, or when the installation is restored from a backup. Turning cloud storage off does not erase templates already on readers. To remove those, reset fingerprint links and use Erase unlinked fingerprints on each kiosk.
Backups
Portable dashboard backups exclude fingerprint templates, sharing settings, and the encryption key. They do include password hashes, encrypted integration secrets, and attendance history, so protect them like an Admin password. Raw database exports and copies of a kiosk's local files are more sensitive still and may contain information already deleted from the live installation.
Retiring or repurposing a kiosk
Retiring a kiosk in the dashboard stops its credential working, but it cannot erase the Pi. Before giving a kiosk away or reusing it, remove its member links in Authentication maintenance on the kiosk and wipe or replace its SD card.
Deletion and contact
Data stays in your installation until an Admin deletes it in Settings › Data. Exporting a report or backup creates a copy and does not remove anything.
Send privacy and security questions to robolancers@gmail.com. Do not include credentials, attendance records, or backups. Community support is best-effort with no response-time commitment. The full privacy reference covers each boundary in detail.