Privacy Policy

What We Collect

DevSafe collects only what is needed to run the service and improve it. Nothing more.

• Email address when you create an account. We use it to send you product updates and account notifications.
• Usage analytics (optional). Basic product metrics like backup frequency and error rates. You can turn this off in settings.
• Crash reports when something breaks. These contain technical diagnostics (OS version, error stack traces) but never your code, keys, or file contents.
• Signup interaction patterns when you create an account. We analyze how you interact with the signup form to distinguish real users from automated software. We never record what you type. Raw interaction data is processed into a single numeric score during your signup request and immediately discarded. Only the score and a risk classification are stored. This data is automatically deleted after 90 days and is never shared with third parties.

That's it. Four things.

What We Don't Collect

This list matters more than the one above.

• Your source code, commit history, or repository contents
• Your encryption keys or recovery phrase
• The contents of your backups
• Your cloud storage credentials (those stay on your machine)
• Browsing history, location data, or device fingerprints
• Raw behavioral data from form interactions (only an aggregate score is stored)

How We Use Your Data

• Email: account notifications, product updates, and support. No marketing spam. No third-party lists.
• Analytics: understanding which features work and which need fixing. Aggregated. Never tied to your identity.
• Crash reports: diagnosing bugs so we can ship fixes.

We do not sell your data. We do not share it with advertisers. We do not run ads. Period.

Legal basis (GDPR): We process your data under legitimate interest (running the service and fixing bugs), contract performance (delivering the product you signed up for), and consent (optional analytics you can turn off). We do not process data beyond what is necessary for these purposes.

California residents (CCPA): We do not sell personal information. We do not share personal information for cross-context behavioral advertising. You have the right to know what we collect, request deletion, and opt out of any future sale. We will never discriminate against you for exercising these rights.

Your Encryption

Your backups are stored in your own cloud bucket (Cloudflare R2, AWS S3, Backblaze B2, or any S3-compatible provider). DevSafe pushes encrypted blobs to your storage. We never have credentials to your bucket.

If you lose your encryption key and recovery phrase, your backups are gone. We cannot recover them for you. This is the tradeoff of real encryption, and we think it's the right one.

Third Parties

We do not sell, rent, or trade your personal information. We do not use third-party advertising networks or tracking pixels.

Services we use to operate DevSafe:

• Google Fonts for web typography. When you load our website, your browser connects to Google's servers to fetch fonts. Google may collect your IP address and browser metadata. See Google's Privacy Policy.
• Resend for transactional email (account notifications only)
• Error monitoring for crash reports (technical data only, no PII)
• Stripe for payment processing if you subscribe to a paid plan (we never store your card number)

Each provider is held to data processing agreements that limit what they can do with the data they handle. A current list of sub-processors is published on our Trust Center.

Cookies

The DevSafe website uses one cookie: your theme preference. That is stored in localStorage, which technically is not even a cookie.

No tracking cookies. No analytics cookies. No third-party cookies. If we ever add analytics to the website, they will be privacy-respecting and clearly disclosed here first.

Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct any inaccurate information
• Delete your account and all associated data
• Export your data in a portable format
• Opt out of usage analytics at any time

These rights apply regardless of where you live. You do not need to cite a regulation. Just ask.

Data Retention

We keep your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days. This includes any associated crash reports and analytics data.

Your encrypted backups live in your own storage. We do not control them and cannot delete them. When you remove DevSafe, your backups stay in your bucket until you decide what to do with them.

Crash reports and analytics are retained for 90 days, then deleted.

Children

DevSafe is a developer tool. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Data Breach Notification

If we discover a breach affecting your personal data, we will notify you by email within 72 hours of becoming aware of it (as required by GDPR Article 33). We will tell you what happened, what data was affected, and what we are doing about it.

Because your backups are encrypted with keys we never hold, a breach of our systems cannot expose your source code or repository contents.

Governing Law

This Privacy Policy is governed by the laws of the State of Wyoming, United States. If you are located in the European Economic Area, you also retain all rights under the GDPR.

Changes to This Policy

If we change this policy, we will update the effective date at the top and notify you by email if the changes are significant. We will not quietly reduce your rights.

Contact

Questions about this policy or how we handle your data? Reach out.