Privacy & cookies.

Google Analytics

This site uses Google Analytics 4 to understand how many people visit and which pages they read. Analytics is off by default on every visit: no analytics cookies are set and no analytics requests are sent until you click "Accept" on the banner shown at the bottom of the page.

If you click "Accept", Google Analytics cookies are set and full visit data (pages viewed, approximate location, device type) is recorded. If you click "Reject", no cookies are set and no per-visit data is recorded.

Your choice is remembered in your browser's local storage so the banner does not reappear on later visits, and you can change your mind at any time by clearing your browser's site data for this domain.

Account data

If you create an account, we collect the name and email address you provide, and store your password as an irreversible hash - never in a form we or anyone else could read back. We process this data to provide the account service you have requested (our lawful basis is contract, under UK GDPR Article 6(1)(b)), and keep it for as long as your account exists.

To confirm you own the email address you signed up with, and to let you reset your password if you forget it, we send a one-time link to that address using Azure Communication Services (Microsoft), hosted in the UK for the same reason described below under Multi-factor authentication. Until you click the verification link, you cannot sign in - this is part of providing the account service you requested (Article 6(1)(b)), the same lawful basis as the rest of this section. Each link expires after 1 hour and is not used for marketing or tracking.

Signing in sets a session cookie so the site can recognise you as logged in. This cookie is strictly necessary to provide the account service you asked for and is exempt from active consent under PECR, but we disclose it here regardless: it stores only a random session token, is not used for tracking or analytics, and is not shared with any third party.

You have the right to access, correct, export, or delete your account data at any time. Visit your account page to download a copy of everything held on your account (UK GDPR Article 15) or permanently delete your account (UK GDPR Article 17) - deletion is immediate and cannot be undone. If you need help with either, or want to exercise any other right under UK GDPR (rectification, restriction, objection), email legal@devafusion.com; we will respond within one month as required by law.

Bot protection (Cloudflare Turnstile)

The sign-up, log-in and forgot-password forms use Cloudflare Turnstile to verify you are a real person rather than an automated script, since this site has no separate firewall in front of it. Turnstile runs a background check (your IP address and some browser signals are sent to Cloudflare) and, only if that check is inconclusive, may ask you to tick a single checkbox - it never shows an image or text puzzle. Our lawful basis for this processing is legitimate interests (UK GDPR Article 6(1)(f)): protecting the account service from automated abuse, which also protects genuine users of it. See Cloudflare's privacy policy (Section 18, Turnstile Privacy Addendum) for what Cloudflare itself does with this data; Cloudflare, Ltd. (County Hall, Belvedere Road, London SE1 7PB) is its UK entity. In the configuration used on this site, Turnstile does not set any cookie - if that ever changes (Cloudflare's "pre-clearance" mode, not currently enabled, sets a cf_clearance cookie), this page will be updated to disclose it before it is switched on.

Multi-factor authentication (MFA)

If you enable a second sign-in factor (an authenticator app or an emailed code), we store an encrypted copy of the authenticator app secret, a hashed copy of any backup codes you generate, and which factors your account requires. Our lawful basis for this processing is our legitimate interest in the security of the account service (UK GDPR Article 6(1)(f)) and, where applicable, our legal obligation to protect personal data (Article 6(1)(c)). We keep this data for as long as your account exists, or until you turn the feature off, whichever is sooner.

If you choose to receive a code by email, we use Azure Communication Services (Microsoft) to send it, hosted in the UK. We chose this provider specifically because it lets us keep this data within the UK, rather than a provider that would move it outside the UK. The email contains only a one-time code and expires after three minutes; it is not used for marketing or tracking.

If you choose to trust a device for 30 days, we set an additional strictly necessary cookie containing a random token - not a hardware fingerprint or any identifying information about your device - so we can recognise that browser without asking for a second factor again during that window. This is exempt from active consent under PECR (it is required to provide the security feature you asked for), but we disclose it here regardless. In-progress sign-in attempts (which factor you have completed so far) are held in server memory for at most three minutes and are never written to a database, per the data minimisation principle (UK GDPR Article 5(1)(c)).

Accessibility theme preference

If you choose a colour theme, text size, or touch-target size from the controls in the site footer, that choice is saved in strictly necessary cookies (devafusion-a11y-theme, devafusion-a11y-scale, and devafusion-a11y-target) so the site can apply it immediately on your next visit, before the page renders. These cookies store only your chosen preference value, are not used for tracking or analytics, and are not shared with any third party. Selecting "System" removes the theme cookie and returns the site to following your browser's own light or dark mode setting.

By default, every interactive control on this site (buttons, links, checkboxes) meets a minimum touch-target size of 24×24 CSS pixels, the widely adopted baseline under WCAG 2.2 (Level AA, Success Criterion 2.5.8). If you would like larger, easier to reach controls, selecting "AAA (44px)" opts up to the enhanced 44×44 CSS pixel target (Level AAA, Success Criterion 2.5.5) instead - this is always an explicit choice you make.

One control on this site - the "Permanently delete my account" button on your account page - always meets the enhanced 44×44 pixel target regardless of this setting. Deleting your account cannot be undone, so that one action is never made smaller by your own preference, even though every other control on the site respects it.

See the accessibility page for a full explanation of these options, how each maps to WCAG 2.2, and an honest account of where this site does and does not yet meet the strictest (AAA) level.

What is not collected

This site does not sell or share your data with third parties beyond Google Analytics, Cloudflare Turnstile, and Azure Communication Services (used for every account's verification and password-reset emails, and additionally for email-based MFA if you enable it), all described above. It does not run advertising and does not use any tracking cookies other than the analytics cookies described above. The accessibility preference, session, and trusted-device cookies described above store only your chosen theme, text size, session token, or MFA trust status, and are not used for tracking.

Questions

For privacy or data questions, email legal@devafusion.com or see the contact page.