Privacy Policy

1. Who We Are

This devEco.io instance is operated by its administrator (the "data controller"). devEco.io is powered by CommonPub, an open-source, self-hosted platform. Each instance is independently operated and responsible for its own data processing.

2. What Data We Collect

When you create an account, we collect:

• Account data: email address, username, password (stored as a secure hash)
• Profile data: display name, bio, headline, location, website, avatar, banner image, social links, skills, pronouns, timezone (all optional)
• Content: projects, articles, comments, and other content you create
• Activity data: likes, follows, bookmarks, hub memberships, learning path enrollments
• Messages: direct messages you send to other users on this instance

We also automatically collect:

• Session data: IP address and browser user agent when you log in, stored for the duration of your session (up to 7 days)
• Theme preference: your light/dark mode choice, stored in a cookie on your device and set only when you use the theme toggle

3. Your Profile, and the Questions We Ask

Your profile is public because that is what a profile is. Your name, your photo, your bio, the links you add and the rest of it are shown to other people because you put them there for that reason.

The questions this site asks you are a different thing. Your answers are kept for you and for the administrators of this site, and they are not shown on your profile unless the operator of this site has marked that particular question as one that appears there. Nothing you answer is published by default, and a question can be asked for purely practical reasons with the answer never leaving your account.

Administrators of this site can see your answers, in the same way they can already see your account. We say so here rather than implying otherwise.

Your answers are counted into group totals, described in section 8, and you can object to that.

Nothing you answer reaches anyone outside this site unless you turn on one of the choices in section 9. Each one is off until you do.

4. How We Use Your Data

• Providing the service: displaying your profile, publishing your content, delivering notifications
• Authentication: verifying your identity when you log in
• Security: protecting against unauthorized access, abuse, and spam
• Email notifications: sending notification digests and alerts you've opted into (configurable in settings)

5. Legal Basis for Processing

We process your data under the following legal bases (GDPR Article 6):

• Contract performance (Art. 6(1)(b)): processing necessary to provide you with the service you signed up for
• Legitimate interest (Art. 6(1)(f)): session security, rate limiting, and preventing abuse
• Legitimate interest (Art. 6(1)(f)): community statistics over this site's own members, described in section 8, which you can object to at any time
• Consent (Art. 6(1)(a)): the choices in section 9 about parties outside this site, each of them off unless you turn it on

6. Cookies

We use a small number of cookies to provide and improve the service. These are strictly necessary and are set whether or not you accept anything else:

• better-auth.session_token: Authenticates your login session. HttpOnly and secure. Kept for 7 days.
• cpub-consent: Stores your cookie consent choice, and what you were asked about when you made it. Kept for 1 year.
• cpub-color-scheme: Remembers your light/dark mode preference. Set only when you use the theme toggle. Kept for 1 year.
• cpub-verify-dismissed: Remembers that you dismissed the email confirmation reminder. Set only when you dismiss it. Kept for until you close your browser.
• cpub-persona-invite-dismissed: Remembers that you dismissed the invitation to fill in your profile details. Set only when you dismiss it. Kept for 1 year.

We use analytics cookies, described in section 7 below. They are set only if you accept them, and never for advertising. For the full list of cookies and to change your choice, see our Cookie Policy.

7. Analytics

We use Google Analytics 4 to understand how this site is used, so we can see which pages people find and which ones they cannot. It runs only if you choose "Accept all" in the cookie banner. If you choose "Essential only", or ignore the banner, nothing is loaded and no analytics cookies are set.

What is collected

• The address and title of each public page you visit, and the order you visit them in. The address is sent without anything after the ?, so what you type is removed before it leaves your browser.
• The site or search engine that referred you here, if any
• Approximate location, derived from your IP address and no more precise than a city
• Device type, screen size, browser and operating system
• A randomly generated id stored in a cookie, so a repeat visit is not counted as a new person
• Some interactions on public pages that Google LLC records automatically: how far down a page you scroll, clicks on links that lead off this site, file downloads, and video engagement

What is not collected

• Your name, email address, or anything else from your account. We never send account data to Google LLC, so analytics cannot be linked back to who you are on this site.
• Your full IP address. It is used to derive an approximate location and is not stored by us.
• Anything you type. The part of a web address after the ? is removed before it is sent, so a search you run here is recorded as a visit to the search page and never includes what you searched for.
• Anything on a page you need to be logged in to see. Pages that require an account, including your settings, your messages, your notifications and the admin area, send nothing at all, not even their titles.
• We run no advertising, we do not track you across other websites, and we do not sell or share this data with anyone beyond the processor named below.

Who processes it, and where

Google LLC acts as our processor and may process this data outside your country, including in the United States. Their handling is governed by the Google LLC privacy policy. Our legal basis is your consent (Art. 6(1)(a)), which you can withdraw at any time from the Cookie Policy page. Withdrawing deletes the analytics cookies from this device and stops the analytics code storing anything or reporting your visits, so collection stops there and then. If any of those cookies are still present the next time a page loads, they are deleted again.

If we later change what analytics is used for, or who processes it, your previous answer no longer applies and you will be asked again rather than carried over.

Checking this for yourself

This site runs on CommonPub, which is open source, so you do not have to take our word for any of the above. The code that loads analytics, including the rule that nothing loads before you accept, is plugins/analytics.client.ts, and the full list of what each provider is allowed to contact and which cookies it sets is packages/config/src/analytics.ts. You can also confirm it in your own browser: open developer tools and check that no request to Google LLC is made until you accept.

8. Community statistics

This is not a consent question: the site counts its own members either way. What you have instead is the right to object, and objecting is honoured in the numbers.

Our legal basis is legitimate interest (Art. 6(1)(f)), not your consent, and the right that comes with it is the right to object (Art. 21). The way to exercise it is one control in your Privacy settings, labelled "Leave me out of statistics entirely". You are counted until you use it.

Objecting stops your answers being counted in new totals, usually within a day. Totals already published are not recalculated, so it cannot remove you from those. Your answers stay in your account.

What exactly is counted, and the smallest number of people a total needs before it is shown at all, are stated in full beside that control. That number is chosen by the operator of this site, so a general one stated here could understate the protection you actually have.

9. Choices about people outside this site

These are separate from cookies, and they are the only decisions on this page that are yours to make. Each one sends something about you to a party we have named, each is off unless you turn it on, turning one off is one click on the same control that turned it on, and our legal basis for every one of them is your consent (Art. 6(1)(a)). Which of these this site offers, the parties each one names, and the exact wording that applies here are all shown beside the switch in your Privacy settings.

None of these choices shares your email address, and none of them creates a way for anyone to contact you other than the messages any account on this site can already send you.

10. Federation and ActivityPub

This instance participates in the ActivityPub federation protocol. When you publish content or interact publicly, the following data may be shared with remote instances:

• Your username, display name, avatar, and bio
• Your published content (projects, articles, explainers)
• Your public interactions (likes, follows, comments on federated content)

Your email address, location, social links, timezone, and other private profile fields are never shared via federation.

Important: Once your data is federated to remote instances, this instance cannot guarantee its deletion on those servers. Remote instances operate independently and may retain cached copies of your public data even after you delete your account here.

11. Third-Party Services

We load icon fonts from Font Awesome via the Cloudflare CDN (cdnjs.cloudflare.com). This means your browser makes requests to Cloudflare's servers, which are subject to Cloudflare's privacy policy.

We use Google Analytics 4 for visitor analytics, described in section 7. We do not use advertising networks, and we do not track you across other websites.

12. Data Retention

• Account data: retained until you delete your account
• Session data: automatically expires after 7 days of inactivity
• Content: retained until you delete it or delete your account
• Audit logs: retained per the instance operator's policy

13. Your Rights

Under the GDPR and similar data protection laws, you have the right to:

• Access: view the data we hold about you (via your profile and settings)
• Rectification: update or correct your data (via your profile settings)
• Erasure: delete your account and all associated data (via account settings)
• Portability: download your data in a machine-readable format (via account settings)
• Objection (Art. 21): the community statistics in section 8 run on legitimate interest, and the control that stops them counting you is in your Privacy settings. For anything else, contact the instance administrator.

To exercise these rights, visit your account settings or contact the instance administrator.

14. Contact

For privacy-related inquiries, contact the administrator of this devEco.io instance.