Last updated: 2026-06-15 | Effective: 2026-07-20
Legal
Privacy Policy
DevStackIO is built on a privacy-first architecture. All tool processing occurs client-side in your browser. We do not store, transmit, or process your data on our servers.
Key Promise: Your code, files, and data never leave your browser. We implement client-side processing by design — not as a feature, but as our foundational architecture.
1. Controller & Contact
Pursuant to Article 4(7) GDPR, the data controller is:
DevStackIO
Email: contact@devstackio.com
Privacy Inquiries: contact@devstackio.com
Data Protection Officer: contact@devstackio.com
Postal: DevStackIO, 123 Developer Way, San Francisco, CA 94102, USA
EU Representative (Art. 27 GDPR): Available upon request at contact@devstackio.com
2. Lawful Basis for Processing (GDPR Art. 6)
We process personal data only where we have a valid lawful basis under Article 6 GDPR:
| Processing Activity | Lawful Basis (Art. 6) | Details |
|---|---|---|
| Server logs (IP, UA, timestamps) | Art. 6(1)(f) — Legitimate Interest | Security, fraud prevention, DDoS protection, platform stability |
| Analytics (GA4) | Art. 6(1)(a) — Consent | Only with explicit opt-in via cookie banner; anonymized IP |
| Cookie preferences | Art. 6(1)(c) — Legal Obligation / Art. 6(1)(f) | Required for ePrivacy compliance; legitimate interest for essential cookies |
| Theme/preferences (localStorage) | Art. 6(1)(f) — Legitimate Interest | Strictly client-side; no server transmission; essential for UX |
| Contact form submissions | Art. 6(1)(b) — Contract / Art. 6(1)(f) | Responding to inquiries; legitimate interest in business communication |
| Advertising (AdSense) | Art. 6(1)(a) — Consent | Only with explicit opt-in; personalized ads disabled by default |
| Security scanning (Cloudflare WAF) | Art. 6(1)(f) — Legitimate Interest | Protection against attacks, bot mitigation, platform integrity |
No "Contract" basis for tool usage: Since all tool processing occurs client-side and we do not process your tool inputs on our servers, Article 6(1)(b) does not apply to the core tool functionality. You are the controller of your data; we are not a processor for your tool inputs.
3. Categories of Personal Data Processed
We minimize data collection. The following categories may be processed:
A. Technical Data (Automatically Collected)
- IP address (temporarily via Cloudflare for security/rate limiting)
- Browser type, version, language, operating system
- Screen resolution, viewport size, color depth
- Referring URL, pages visited, timestamps
- Request headers, response codes, latency metrics
B. Analytics Data (Consent-Based)
- Pseudonymous user ID (GA4 client_id)
- Page views, scroll depth, tool interactions
- Session duration, bounce events
- Geolocation (country-level only, IP anonymized)
- Device category (desktop/mobile/tablet)
C. Cookie & Preference Data
- Cookie consent choices (necessary/analytics/advertising/functional)
- Theme preference (dark/light) — stored locally, not transmitted
- Tool-specific settings (indentation, encoding preferences) — client-side only
D. Contact Form Data (Voluntary)
- Name, email address, subject, message content
- Optional: organization, phone number
NOT Processed by Us (Client-Side Only)
- Tool inputs: code, text, files, JSON, SQL, regex patterns, etc.
- Tool outputs: formatted, encoded, converted, or generated data
- Generated secrets: passwords, JWTs, UUIDs, keys, certificates
- Any data processed entirely within your browser
4. Purposes of Processing
We process personal data only for the following specific, explicit, and legitimate purposes:
1. Service Delivery & Security (Art. 6(1)(f))
- Deliver static assets via CDN (Cloudflare)
- DDoS protection, WAF, bot mitigation
- Rate limiting, abuse prevention, fraud detection
- Platform stability and uptime monitoring
2. Analytics & Improvement (Art. 6(1)(a) — Consent)
- Understand tool popularity and usage patterns
- Identify errors, performance bottlenecks, UX issues
- Prioritize feature development and bug fixes
- No profiling, no automated decision-making
3. Advertising (Art. 6(1)(a) — Consent)
- Display relevant ads via Google AdSense
- Measure ad performance and prevent fraud
- Only with explicit consent; non-personalized by default
4. Communication (Art. 6(1)(b)/(f))
- Respond to contact form inquiries
- Send critical service notifications (security, legal)
- No marketing emails without separate opt-in
5. Legal Compliance (Art. 6(1)(c))
- Comply with valid legal requests, court orders
- DMCA/copyright takedown processing
- Regulatory reporting obligations
5. Recipients & Subprocessors
We share personal data only with the following categories of recipients, each bound by contractual data protection obligations (Art. 28 GDPR):
| Recipient | Purpose | Legal Basis | Location | DPA Status |
|---|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, WAF, DDoS, Analytics | Legitimate Interest / DPA | Global (US HQ) | Executed (SCCs + DPF) |
| Google LLC (GA4) | Analytics (with consent) | Consent (Art. 6(1)(a)) | Global (US HQ) | Executed (SCCs + DPF) |
| Google LLC (AdSense) | Advertising (with consent) | Consent (Art. 6(1)(a)) | Global (US HQ) | Executed (SCCs + DPF) |
| Vercel / Hosting Provider | Static hosting, edge functions | Legitimate Interest / DPA | Global (US HQ) | Executed (SCCs + DPF) |
| Email Provider (Transactional) | Contact form delivery | Contract (Art. 6(1)(b)) | Global | Executed |
A full subprocessor list is available on request. All subprocessors execute Data Processing Agreements with SCCs and adhere to EU-US Data Privacy Framework where applicable.
6. International Data Transfers
Some subprocessors are located outside the EEA/UK. We ensure adequate safeguards under Chapter V GDPR:
Standard Contractual Clauses (SCCs)
All subprocessors outside EEA/UK/CH execute EU Commission-approved SCCs (2021/914) as Controller-to-Processor or Processor-to-Processor modules, supplemented by UK Addendum where applicable.
EU-US Data Privacy Framework
US-based subprocessors (Cloudflare, Google, Vercel) self-certify under the EU-US DPF (2023 adequacy decision). UK Extension applies for UK data flows.
Transfer Impact Assessments (TIAs)
We conduct TIAs for all third-country transfers, evaluating: local surveillance laws, government access mechanisms, data subject rights enforceability, and supplementary measures (encryption, pseudonymization).
No Transfer of Your Tool Data
Critically, your tool inputs and outputs never leave your browser. No international transfer occurs for your code, files, or generated outputs.
7. Data Retention Periods
We retain personal data only as long as necessary for the purposes outlined above, or as required by law:
| Data Category | Retention Period | Basis |
|---|---|---|
| Server access logs (IP, UA, timestamps) | 30 days (rolling) | Security, Art. 6(1)(f) |
| Cloudflare analytics (aggregated) | 13 months | Analytics, Art. 6(1)(f) |
| GA4 client_id, events (with consent) | 14 months (GA4 default) | Consent, Art. 6(1)(a) |
| Cookie consent record | 12 months from last update | ePrivacy, Art. 6(1)(c) |
| Theme/preferences (localStorage) | Until cleared by user | Legitimate interest, client-side |
| Contact form submissions | 12 months after resolution | Contract/Legitimate interest |
| DMCA/copyright records | 3 years | Legal obligation (17 USC 512) |
| Security incident logs | 2 years | Legal obligation, Art. 6(1)(c) |
| Tool inputs/outputs (client-side) | Never (never on our servers) | N/A — client-side only |
After retention periods expire, data is securely deleted or irreversibly anonymized. Backups are purged within 30 days of primary deletion.
8. Your Rights (GDPR Arts. 15-22, CCPA)
You have the following rights regarding your personal data. We honor all applicable rights:
Right of Access (Art. 15 GDPR, §1798.100 CCPA)
Request confirmation of processing and a copy of your personal data.
Right to Rectification (Art. 16 GDPR)
Request correction of inaccurate or incomplete personal data.
Right to Erasure / "Right to Be Forgotten" (Art. 17 GDPR, §1798.105 CCPA)
Request deletion where data is no longer necessary, consent withdrawn, or processing unlawful.
Right to Restriction (Art. 18 GDPR)
Request limitation of processing pending verification or objection.
Right to Data Portability (Art. 20 GDPR)
Receive your data in a structured, commonly used, machine-readable format.
Right to Object (Art. 21 GDPR)
Object to processing based on legitimate interest (Art. 6(1)(f)) or direct marketing.
Rights re: Automated Decision-Making (Art. 22 GDPR)
Not applicable — we do not engage in automated decision-making or profiling with legal effects.
Right to Withdraw Consent (Art. 7(3) GDPR)
Withdraw cookie/analytics consent anytime via Cookie Preferences in footer.
CCPA Rights (§1798.100-1798.199)
Know, access, delete, opt-out of sale (we don't sell), non-discrimination for exercising rights.
How to Exercise Your Rights
Email contact@devstackio.comor use our contact form. We verify identity and respond within 30 days (extendable to 60 days for complex requests). No fee for standard requests.
Supervisory Authority Complaint
You have the right to lodge a complaint with a supervisory authority, e.g.:
- EU: Your national DPA
- UK: ICO
- CA: OPC
9. Data Security Measures (Art. 32 GDPR)
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
Encryption & Transport
- TLS 1.2+ for all traffic (HSTS with preload)
- Certificate Transparency monitoring
- No server-side storage of user content = no encryption-at-rest needed for tool data
Application Security
- Strict per-route hash-based CSP served at edge; no nonces
- Subresource Integrity (SRI) for all third-party resources
- Permissions-Policy restricting browser features
- Referrer-Policy: strict-origin-when-cross-origin
- X-Content-Type-Options: nosniff; X-Frame-Options: DENY
Infrastructure & Resilience
- Global CDN with DDoS protection (Cloudflare)
- WAF with OWASP Top 10 rules
- Static hosting on edge network (99.9%+ uptime SLA)
- Service Worker for offline-capable tool access
Organizational Measures
- Privacy by design: client-side architecture eliminates server-side data risk
- Minimal data collection principle
- No employee access to user tool data (architecturally impossible)
- Regular dependency scanning (Dependabot, Snyk)
- Incident response plan with 24-hour notification target
- Annual security review and penetration testing
Testing & Monitoring
- Automated security scanning in CI/CD pipeline
- CSP violation reporting and monitoring
- Dependabot alerts for vulnerable dependencies
- Regular third-party penetration testing
10. Automated Decision-Making & Profiling
We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you (Art. 22 GDPR).
No Automated Decisions
No algorithmic decision-making affects your legal status, rights, or access to services. Tool outputs are deterministic transformations of your input — you remain in full control.
No Profiling
We do not build profiles of your behavior, preferences, or characteristics for automated decisions. Analytics data is aggregated and pseudonymized; no individual profiling occurs.
12. Children's Privacy (COPPA, GDPR Art. 8)
DevStackIO is a developer tools platform intended for professionals, students, and hobbyists. We do not knowingly collect personal data from children under 13 (US) or under the age of digital consent in their jurisdiction (13-16 per GDPR Art. 8).
If You Are a Parent/Guardian
If you believe your child has provided personal data, contact us atcontact@devstackio.com. We will verify and delete promptly.
Age Verification
We do not implement age gates as our tools do not target children. Contact form includes "I am 13+" checkbox. Analytics consent requires affirmative action (no pre-checked boxes).
13. Changes to This Policy
We may update this Privacy Policy to reflect legal changes, new features, or operational improvements.
- Material changes: Posted on this page with updated "Last updated" date; website banner notification; email to registered API users (if applicable).
- Effective date: 30 days after posting (or immediately for legal compliance).
- Version history maintained at bottom of this page.
- Continued use after effective date constitutes acceptance.
Version History
- 2026-07-20 (v2.0)
- Full GDPR Art. 13/14 compliance; DPA reference; lawful basis table; international transfers; retention schedule; children's privacy.
- 2026-06-15 (v1.0)
- Initial version.
14. Contact & Data Protection Officer
General Privacy Inquiries: contact@devstackio.com
Data Protection Officer (DPO): contact@devstackio.com
Data Subject Requests: contact@devstackio.com
Security Vulnerabilities: contact@devstackio.com
EU Representative (Art. 27 GDPR): contact@devstackio.com
Postal: DevStackIO, Privacy Team, 123 Developer Way, San Francisco, CA 94102, USA
We respond to all legitimate requests within 30 days (extendable to 60 days for complex requests). No fee for standard requests. Identity verification may be required.