# Privacy Policy **Version {{ policy_version('privacy') }}.** This page states what data DevPlace collects, how it is used, and how it is retained, deleted and shared. ## 1. Data DevPlace collects | Category | What | Why | |---|---|---| | Account | Username, email address, password hash, API key | Identify you and secure your account | | Age band | The band derived from your declared date of birth (`13_15`, `16_17`, `adult`) | Enforce the minimum age and age-appropriate access. **The date of birth itself is never stored.** | | Profile | Bio, location, links, avatar seed, timezone | Shown on your public profile | | Content | Posts, comments, gists, projects, project files, quizzes, polls, awards, uploads, direct messages, issue reports | The service itself | | Activity | Last-seen timestamp, contribution calendar, XP and badges, notification and read state | Presence, gamification and notifications | | Technical | IP address and user agent on audit-relevant actions, request timing | Security, abuse prevention and rate limiting | | Assistant | Prompts and results of assistant, search and analysis features you invoke | Deliver the feature and attribute its cost to you | | Moderation | Reports you file, reports filed about you, and decisions taken | Operate the safety controls the platform is required to have | | Donated bandwidth | Only if you donate: your device label and secret hash, a keyed hash of your IP address (never the address itself), an approximate country and network class (looked up locally from the DB-IP lite database, licensed CC BY 4.0, https://db-ip.com; the address is never sent to a third party), request and byte counters, and node events | Run the community node network and show you what you donated. See section 10. | | Imported community content | Where an administrator synchronises an external community: public usernames, bios, locations, links, posts, comments, polls, projects, follows, votes, reactions and attachments published there, as the origin made them public. No email address, password, XP or role is imported, and imported accounts cannot sign in. Imported rows may be reported and removed like any other content | Mirror a public community inside DevPlace. If you are the author of imported content, ask for its removal through a report or by contacting an administrator. | DevPlace runs **no third-party analytics, no advertising and no cross-site or cross-app tracking**. There is no tracking identifier shared with any other company. ## 2. How the data is used Only to run the service: to show your content to the people you published it to, to authenticate you, to notify you, to keep the platform safe, and to bill and cap AI usage. It is never sold, and it is never used to build an advertising profile. ## 3. Third parties | Recipient | What is sent | When | |---|---|---| | {{ ai_provider_name() }} | The text you asked an assistant feature to process | **Only after you grant `ai_third_party` consent.** Default: not granted. | | Push services (Apple, browser push endpoints) | An encrypted notification payload to a device you registered | Only when you register a device and enable a push channel | | Telegram | Messages in the Telegram conversation you paired | Only when you pair Telegram yourself | | Software another member runs in a container | Your DevPlace API key and user id, injected as `DEVPLACE_API_KEY` and `DEVPLACE_USER_UID` | **Only after you grant `container_credentials` consent**, and only when the container is run by someone else. Your own containers use your own credentials with no separate consent. | | External communities an administrator synchronises | Requests to those sites, and an account the administrator supplied for a login-protected one | Administrator action only. No member data is sent. | | The site fetched through your connection | Your public IP address, as the destination sees it | **Only after you grant `bandwidth_sharing` consent**, register a device and switch donation on | | Email and issue-tracker hosts you configure | The content you send through them | Only when you configure them yourself | Every one of these is under your control, is off unless you turn it on, and can be revoked from your profile privacy tab. ## 4. Consent DevPlace records six consents, each versioned, each independently grantable and withdrawable, with the full history retained so a decision is always provable: - `terms` - acceptance of the Terms of Service and Community Guidelines; - `privacy` - acknowledgement of this policy; - `ai_third_party` - processing of **your own content** by a third-party AI model provider; - `activity_recording` - recording of your presence and session activity; - `container_credentials` - sharing your credentials with software another member runs in a container; - `bandwidth_sharing` - sharing part of your internet connection with the community node network. Withdrawal takes effect immediately. Withdrawing `ai_third_party` turns every assistant feature that would send your content off, whatever the per-feature preference says. Withdrawing `activity_recording` stops presence writes; you simply appear offline. Manage the consents at `/profile/{username}?tab=privacy`. ## 5. Retention and deletion **You can delete your account yourself**, at any time, from your profile. It asks for your password, tells you exactly what happens, and then: 1. every session and access token is revoked immediately; 2. your username is tombstoned and your email, bio, location, links, avatar seed, API key and password hash are cleared immediately - from your point of view and everyone else's, the account is gone the moment you confirm; 3. your content is removed from every surface under one deletion event; 4. after a short reversible window (published on the deletion page, so an accidental deletion can be undone), the whole event is permanently purged. Retained after purge: append-only audit and moderation records required to show that the platform enforced its own rules, holding actor identifiers rather than your personal profile; and backup archives until they rotate out on their normal schedule. ## 6. Your rights You can access your data (every surface is also a JSON API), correct it (edit your profile and content), export it (the API and the per-tool export endpoints), restrict processing (withdraw a consent), and erase it (delete your account). To exercise a right that the product does not cover directly, use the [Contact](/docs/contact.html) page. ## 7. Security Passwords are hashed with PBKDF2-SHA256 and never stored or transmitted in the clear. Sessions are opaque tokens. Administrative and database access is restricted and every state change is recorded in an append-only audit log. ## 8. Children DevPlace is not directed at children under {{ moderation_minimum_age() }}. Accounts are refused below that age. If you believe an account belongs to a younger child, report it or use the [Contact](/docs/contact.html) page and it will be closed. ## 9. Changes Material changes bump the version at the top of this page. ## 10. Donated bandwidth The community node network is optional and off until you give the `bandwidth_sharing` consent, register a device and switch donation on. What it processes and keeps: - **IP address and location.** Your IP address is processed to connect your device and to estimate an approximate country and network class (residential, mobile, datacenter). **Only a keyed hash of the address is stored**, never the address. - **Requests.** The table of in-flight requests holds the requested URL and the identifier of the caller for at most 10 minutes, then it is deleted. - **Counters.** Request and byte counts per day and for your lifetime are kept so you can see what you donated. Lifetime totals are kept after old daily figures are cleaned up. - **Events.** Connection and refusal events for your devices are kept for 30 days. - **What the donor device sees.** A device sees the destination host of every request. In fetch mode, which the browser extension uses, it can also read the URL and the page body. Your own requests are not sent through your own device. - **What is never used.** Your cookies, logins and accounts are never used, and only public pages on a fixed allowlist are fetched. Withdrawing the consent switches donation off at once. Removing a device disconnects it and makes its secret useless. See [Donate your connection](/docs/nodes.html). ## 11. Contact Data-protection enquiries go to the address, email and telephone number on the [Contact](/docs/contact.html) page.