What we collect, who we use, and what we won’t claim
A privacy product should be able to answer these questions plainly. Here is exactly what happens on this website and inside the product, the providers involved, and the security claims we deliberately do not make.
Last reviewed 2026-10-08.
What this website collects
Two things run on every visit
Our own analytics, which runs in cookieless mode here, counts the visit, and if you arrive from a campaign link the UTM tags are kept in your browser session and one visit ping is sent, so a signup you later submit can be attributed. Neither stores anything on your device beyond that session. Google Analytics is different: it does not load until you allow the analytics category in the cookie banner.
Cookieless on this site
Our own analytics runs here in cookieless mode: no cookie, no localStorage, no device identifier. A daily, server-derived identifier is used only to avoid double-counting within a day; it is different on every site and stops working at midnight UTC. A keyed hash of your shortened network address is also stored for bot detection; it does not rotate.
Storage without asking
Set without consent: your signed-in session and the answer you give the cookie banner (both in local storage), a device cookie once you sign in (dd_bi, so Device Center can list your browsers), and the UTM tags of a campaign link in session storage for that tab. The functional and marketing categories are off until you allow them.
Account details
If you create an account, your email and the sites you connect. Card details are entered with our payment provider, 2Checkout (Verifone), at checkout, not stored by us.
What the product collects
Traffic, not people
DevDome Analytics records page events, clicks, country, and a human-or-bot verdict. Cookieless mode is the default on new installs; a site owner can opt into a returning-visitor cookie, and when they do the product warns that a cookie is set and consent may be required.
IPs are hashed
A visitor IP is used to resolve country and network reputation and is stored only as a hash, never in the clear.
No cross-site profile
The daily, server-derived identifier includes the site in its input, so the same person on two connected sites never becomes one profile.
The cookie banner categories are: strictly necessary, functional, analytics, and marketing. Only the first is on by default. The analytics category controls Google Analytics; our own measurement runs in cookieless mode here and is not part of that choice because it stores nothing on your device.
Providers we use
These are the third parties that can process data on our behalf. Each links to that provider’s own security or legal documentation.
Cloudflare
Cloudflare Trust Hub →Hosts this website (Workers), delivers it from the edge and runs the Turnstile challenge on our forms. Requests are processed at the edge location nearest the visitor.
Where: Edge location nearest the visitor
Supabase
Supabase security →Authentication, the account database, connected sites and their settings, and the primary store of analytics events. Hosted on AWS in the EU.
Where: eu-central-1 (Frankfurt, Germany)
Hetzner
Hetzner privacy →The analytics reporting database (ClickHouse) that powers the dashboards, on a server we operate.
Where: EU (Finland)
DigitalOcean
DigitalOcean trust →The plugin services backend (api.devdome.com): plugin updates, Amazon stock checks, geo lookups and the free tool checkers, on a server we operate.
Where: EU (Frankfurt, Germany)
2Checkout (Verifone)
How billing works →Payment processing for paid plans: card checkout, recurring charges, applicable taxes and your invoice. Card details are entered on the provider’s own checkout pages and never reach our servers.
Where: On the provider’s own pages, under its own policies
Resend
Resend DPA →Transactional email (verification codes, password resets, account and alert notices) and the newsletter.
Google Analytics
Google privacy →Optional usage measurement of this website. Loads only if you allow the analytics category in the cookie banner.
DevDome Analytics (ours)
How it works →Our own analytics engine on the infrastructure above. On this website it runs on every visit in cookieless mode: it stores nothing on your device, and a server-derived daily identifier is the only thing that tells two visits apart.
Where: EU (the stores named above)
Your data is yours
Get a copy of your data
Request a copy of your account data at any time and we will send it to you.
Contact support →Delete your account
You can delete your account and its data. If you have an active subscription, billing is cancelled first, so deletion never leaves a charge running.
Security →It is your data
We do not sell personal information. We share only with the providers listed above, and only as needed to run the service.
Privacy policy →Security we can show you
- Everything is served over HTTPS/TLS. You can verify the certificate in your browser.
- Sign-in and account pages enforce a strict Content-Security-Policy that blocks injected scripts; account actions require re-authentication and support app-based two-factor.
- Payment card details are entered on 2Checkout (Verifone)’s secure checkout and never reach our servers.
- Passwords are checked against known-breach lists at sign-up and change.
What we do not claim
- We do not claim SOC 2 or ISO 27001 certification.
- We have not commissioned a third-party penetration test, and do not claim one.
- We do not offer a contractual uptime guarantee or SLA.
- We do not promise a residency region narrower than the European Union: stored visitor data lives in the EU stores named above, and Cloudflare processes requests at the edge location nearest the visitor.
- We describe our providers’ security by linking their own documentation rather than restating it as our own guarantee.
Reporting a security issue
Found a vulnerability in the website or a plugin? Email our team with the details and steps to reproduce. We read every report and will confirm receipt. Each plugin page also links a way to report an issue for that specific plugin. The contact is also published at /.well-known/security.txt (RFC 9116) for scanners and researchers.
Straight answers, on the record
Read the full privacy policy, or see how bot detection actually works.