Privacy Policy

We may collect:

• account information, such as your email address, password, and account settings
• contact information you provide, such as emails sent to support or partnerships
• newsletter and marketing preferences
• usage information, such as pages viewed, actions taken, device/browser details, IP address, country derived from IP, and referral information (how this is handled is set out below)
• transactional or business information if you contact us about partnerships, tools, or other services
• billing information for paid plans, such as your name, billing address, country and the payment details you enter at checkout, which are collected and processed by our authorized reseller and merchant of record and not stored on our servers
• technical information used for security, fraud prevention, and debugging
• cookie and similar technology data where used

We do not intentionally collect sensitive personal information unless you choose to provide it.

Two of those bullets carry the detail that matters, so here they are in full.

How visitors are counted. DevDome Analytics measures this website and is also the product our customers install. It is cookieless by default: on devdome.com nothing at all is written to your device by it, and a new customer install behaves the same way unless the site owner turns returning-visitor tracking on, in which case the product tells them a cookie is being set. Instead of an identifier stored on your device, our server derives one from the request, keyed with a secret that never leaves the server. The site and the UTC date are part of that derivation, which has two consequences we will state plainly: the same person on two DevDome-measured sites never becomes one profile, and the identifier stops working at midnight UTC, so someone returning tomorrow is counted as a new visitor. It is not linked to your DevDome account.

What happens to an IP address. Your address reaches our edge, because that is how a request is delivered. With IP anonymisation on, which is the default for every site, the address is cut down to its network before anything else touches it: the last part of an IPv4 address and the last 80 bits of an IPv6 address are zeroed. Only that truncated network is used for our own network and reputation lookup, and only a short hash of it is stored. The full address is never written down. Region and city are dropped rather than guessed from a truncated address; country and network survive the cut. The one lookup we cannot truncate first is Cloudflare’s: it resolves the country at its own edge before our code runs. A site owner can switch anonymisation off for their own site, and then the full address is what gets hashed.

We may use your information to:

• create and manage your account
• provide gated access to features
• send verification emails, password reset emails, service messages, and account-related notices
• send newsletters, product updates, alerts, partner offers, and sponsored promotions
• personalize content, recommendations, and communications
• operate, improve, and secure the Services
• prevent fraud, abuse, spam, and unauthorized access
• analyze usage and performance
• respond to support requests, feedback, and partnership inquiries
• comply with legal obligations and enforce our terms

Some DevDome features require a free account. No feature currently requires a newsletter subscription: unsubscribing today removes no access, and if that ever changes we will say so on the feature itself rather than only here.

You can manage email preferences from your account at any time.

Depending on where you live, we may process personal information based on consent, contract, legitimate interests, or legal obligation. Privacy laws in many regions require transparency about purposes, retention, sharing, and rights, and California law requires additional disclosures about categories of data and rights where applicable.

Depending on applicable law, you may have rights to:

• access your information
• correct inaccurate information
• delete your information
• object to or restrict certain processing
• withdraw consent where processing is based on consent
• request portability where applicable
• opt out of certain marketing communications

Two of these you can exercise yourself, without asking us:

• Delete your account and its data from Account → Security. It asks for your password and a typed confirmation, and it cancels any active subscription before deleting anything, so deletion never leaves a charge running.
• Correct your email address, password and email preferences from your account pages.

For a copy of your data, or for any other request in the list above, reach out via our Contact Page. We assemble and send the copy: there is no download button in the account today, and we would rather say so than point you at one that is not there.

If California privacy law applies to you, we may collect categories of information such as identifiers, internet or network activity, commercial information, geolocation derived from IP, and inferences/preferences based on activity. California rules require disclosures about categories collected, sources, purposes, and rights.

We do not sell personal information in the traditional “data broker” sense. If we ever engage in activity that legally qualifies as “selling” or “sharing” under applicable law, we will provide any required notices and choices.

These are the providers that process personal information on our behalf:

• Cloudflare: hosting for this website, edge delivery, and the Turnstile challenge on our forms
• Supabase: authentication and the account database
• ClickHouse: the analytics event store. We run it ourselves on servers rented from Hetzner rather than using a managed analytics service
• Resend: transactional and newsletter email
• Google: website analytics, and only if you allow the analytics category in the cookie banner
• our authorized reseller and merchant of record, which receives the billing information needed to process your card payment, handle applicable taxes, prevent fraud, and issue your receipt

The current list, with a link to each provider’s own security and legal documentation, is on our Trust page. We may also share information with professional advisers, legal authorities or regulators when required.

We do not sell personal information, and we do not share more than reasonably necessary for these purposes.

Our own code sets no cookie on this website. Your signed-in session and the answer you give the cookie banner are held in your browser’s local storage, and our own analytics runs in cookieless mode here. The only true cookies come from Google’s analytics tag, which does not load at all until you allow the analytics category, and from Cloudflare’s edge under its own policy.

The names, purposes and lifetimes are listed in the Cookie Policy, and you can change your answer at any time on the Cookie Settings page. Where required by law, we request consent before using non-essential cookies and similar technologies.

We keep personal information for as long as reasonably necessary for the purposes described in this Policy. In concrete terms:

• Analytics events are kept for the period the site’s plan allows: 90 days on Free, 13 months on Pro, 24 months on Business, 36 months on Agency. A site owner can set a shorter period in their dashboard; that setting can only shorten the window, never extend it past the plan.
• Account information is kept while the account exists. Deleting your account deletes it, along with the newsletter contact record.
• Billing records are kept for as long as tax and accounting rules require. Your invoices are issued and held by our authorized reseller and merchant of record.

Beyond those periods we keep only what we must to maintain security, meet legal obligations, resolve disputes, and enforce agreements.

We use reasonable technical and organizational measures to protect personal information. However, no method of transmission or storage is completely secure.

DevDome may be accessed from multiple countries. Your information may be processed in countries other than your own, subject to applicable safeguards where required.

DevDome is not directed to children, and we do not knowingly collect personal information from children under the age required by applicable law.

Our Services may link to third-party websites, tools, payment pages, partner offers, or external services. We are not responsible for their privacy practices.

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date.

DevDome is the controller of the personal information described here. DevDome is operated from Kondrashina 17, Odesa, 65021, Ukraine, and you can reach us at support@devdome.com.

If you have questions about this Privacy Policy, or want to make one of the requests in section 4, please reach out via our Contact Page.