Privacy Policy
Version 1. This page states what data DevPlace collects, how it is
used, and how it is retained, deleted and shared.
1. Data DevPlace collects#
| Category | What | Why |
|---|---|---|
| Account | Username, email address, password hash, API key | Identify you and secure your account |
| Age band | The band derived from your declared date of birth (13_15, 16_17, adult) |
Enforce the minimum age and age-appropriate access. The date of birth itself is never stored. |
| Profile | Bio, location, links, avatar seed, timezone | Shown on your public profile |
| Content | Posts, comments, gists, projects, project files, quizzes, polls, awards, uploads, direct messages, issue reports | The service itself |
| Activity | Last-seen timestamp, contribution calendar, XP and badges, notification and read state | Presence, gamification and notifications |
| Technical | IP address and user agent on audit-relevant actions, request timing | Security, abuse prevention and rate limiting |
| Assistant | Prompts and results of assistant, search and analysis features you invoke | Deliver the feature and attribute its cost to you |
| Moderation | Reports you file, reports filed about you, and decisions taken | Operate the safety controls the platform is required to have |
DevPlace runs no third-party analytics, no advertising and no cross-site or cross-app tracking.
There is no tracking identifier shared with any other company.
2. How the data is used#
Only to run the service: to show your content to the people you published it to, to authenticate you,
to notify you, to keep the platform safe, and to bill and cap AI usage. It is never sold, and it is
never used to build an advertising profile.
3. Third parties#
| Recipient | What is sent | When |
|---|---|---|
| our AI model provider | The text you asked an assistant feature to process | Only after you grant ai_third_party consent. Default: not granted. |
| Push services (Apple, browser push endpoints) | An encrypted notification payload to a device you registered | Only when you register a device and enable a push channel |
| Telegram | Messages in the Telegram conversation you paired | Only when you pair Telegram yourself |
| Software another member runs in a container | Your DevPlace API key and user id, injected as DEVPLACE_API_KEY and DEVPLACE_USER_UID |
Only after you grant container_credentials consent, and only when the container is run by someone else. Your own containers use your own credentials with no separate consent. |
| Email and issue-tracker hosts you configure | The content you send through them | Only when you configure them yourself |
Every one of these is under your control, is off unless you turn it on, and can be revoked from your
profile privacy tab.
4. Consent#
DevPlace records five consents, each versioned, each independently grantable and withdrawable, with
the full history retained so a decision is always provable:
terms- acceptance of the Terms of Service and Community Guidelines;privacy- acknowledgement of this policy;ai_third_party- processing of your own content by a third-party AI model provider;activity_recording- recording of your presence and session activity;container_credentials- sharing your credentials with software another member runs in a container.
Withdrawal takes effect immediately. Withdrawing ai_third_party turns every assistant feature that
would send your content off, whatever the per-feature preference says. Withdrawing
activity_recording stops presence writes; you simply appear offline.
Manage all five at /profile/{username}?tab=privacy.
5. Retention and deletion#
You can delete your account yourself, at any time, from your profile. It asks for your password,
tells you exactly what happens, and then:
- every session and access token is revoked immediately;
- your username is tombstoned and your email, bio, location, links, avatar seed, API key and
password hash are cleared immediately - from your point of view and everyone else's, the account
is gone the moment you confirm; - your content is removed from every surface under one deletion event;
- after a short reversible window (published on the deletion page, so an accidental deletion can be
undone), the whole event is permanently purged.
Retained after purge: append-only audit and moderation records required to show that the platform
enforced its own rules, holding actor identifiers rather than your personal profile; and backup
archives until they rotate out on their normal schedule.
6. Your rights#
You can access your data (every surface is also a JSON API), correct it (edit your profile and
content), export it (the API and the per-tool export endpoints), restrict processing (withdraw a
consent), and erase it (delete your account). To exercise a right that the product does not cover
directly, use the Contact page.
7. Security#
Passwords are hashed with PBKDF2-SHA256 and never stored or transmitted in the clear. Sessions are
opaque tokens. Administrative and database access is restricted and every state change is recorded in
an append-only audit log.
8. Children#
DevPlace is not directed at children under 16. Accounts are refused below
that age. If you believe an account belongs to a younger child, report it or use the
Contact page and it will be closed.
9. Changes#
Material changes bump the version at the top of this page.
10. Contact#
Data-protection enquiries go to the address, email and telephone number on the
Contact page.