Privacy Policy
Last updated: August 2026
This policy has not been reviewed by counsel. It describes our actual data handling in plain language. If anything here conflicts with a signed engagement agreement, the signed agreement governs.
What we collect
When you submit the application form at /apply, we collect: your name, email, company or product name, product URL, product stage, selected package, primary problem and desired outcome, optional deadline, whether authenticated product access exists, whether repository review may be relevant, and your consent. A hidden honeypot field is used to detect automated submissions.
We do not ask for, and the form actively rejects, passwords, access tokens, repository credentials, payment details, or other secrets submitted through it.
How it is stored
Accepted applications are encrypted individually with AES-256-GCM using a deployment secret before being written to an append-only file on the server. We store a server-generated receipt, timestamp, and the encrypted record — not a searchable plaintext database. Application logs contain only a receipt, selected package, outcome, and processing time — never your name, email, or message content.
Who sees it
After an application is durably recorded, we send a best-effort notification through Telegram Bot API, and through our email provider if SMTP is fully configured. Those providers process the application data needed to deliver the notification on our behalf. Notification failure does not delete or unrecord your application. We do not sell application data or disclose it for advertising.
Analytics
This release ships without any analytics or tracking script. No Google Analytics, no Matomo, no third-party pixels.
Retention and deletion
We retain accepted applications for at most 12 months. Deletion of an individual record before that is a manual process performed by the site owner — email [email protected] with your receipt (if you have it) or the email address you applied with, and we will locate and remove your record. Automated deletion is not yet in place.
Access arranged later
If a technical-risk review requires authenticated or repository access, that access is arranged through a separate secure channel after qualification — never collected through this website.
Contact
Questions about this policy: [email protected].