Privacy Policy of 9dev.pl

This policy covers only the 9dev.pl website and its report form. Each 9dev app has its own privacy policy, linked from the app page and from the list of documents.

In short

• The website sets no cookies and uses no tracking tools or ads.
• Visit statistics are aggregated and cookieless (Cloudflare Web Analytics).
• The website only remembers your chosen theme, in your browser’s storage.
• Data from the report form is used only to handle your report.

Controller

The controller is Mariusz Uziębło, postal address: (postal address being added). For anything about personal data, write to privacy@9dev.pl.

What data we process and why

Visiting the website

The website is served by Cloudflare (Cloudflare Pages). For every page view, Cloudflare’s servers process technical connection data: IP address, browser and system type, the page address and the time. This is needed to deliver the website and protect it from attacks. We have no access to raw logs with IP addresses.

Visit statistics are collected by Cloudflare Web Analytics. It uses no cookies or browser storage and only shows us aggregated data, such as the number of visits to a page, the country and the device type. It does not build visitor profiles.

Legal basis: our legitimate interest in providing a secure website and knowing the overall number of visits (Art. 6(1)(f) GDPR).

Browser storage

If you switch the website theme (light or dark), we remember your choice in your browser’s storage (localStorage, key theme). It holds only the word “light” or “dark”, is never sent to our server and is not used to recognise you. You can remove it by clearing the site data in your browser. If you do not choose a theme, the website follows your system setting and stores nothing.

Report form

The form lets you report a bug, a security vulnerability, an incident, a personal data request, an account deletion or illegal content. We process:

• the report data: type, app, app version, platform and system version, description and steps to reproduce,
• your email address, if you give it (it is required for personal data and account deletion requests, so that we can verify your identity and reply),
• your full name or company name for illegal content reports, as required by Article 16(2)(c) of Regulation 2022/2065 (DSA); content concerning child sexual abuse can be reported anonymously,
• a hash of your IP address and your browser type, to limit the number of reports and protect the form from abuse. We do not store the IP address itself.

Before sending, the form checks that you are not a bot using Cloudflare Turnstile. Turnstile analyses technical browser signals and does not set tracking cookies.

Reports are stored in a Supabase database on servers in the European Union (Ireland). The notification about your report and your confirmation are sent through Resend.

Legal bases:

• bug reports and questions: our legitimate interest in keeping the apps working and answering users (Art. 6(1)(f) GDPR),
• vulnerability and incident reports: the manufacturer’s obligations under Regulation (EU) 2024/2847 (Cyber Resilience Act) (Art. 6(1)(c) GDPR),
• personal data and account deletion requests: obligations under the GDPR (Art. 6(1)(c) GDPR),
• illegal content notices: obligations under Regulation (EU) 2022/2065 (DSA) (Art. 6(1)(c) GDPR).

Email

Messages sent to addresses in the 9dev.pl domain are forwarded by Cloudflare Email Routing to a Gmail mailbox (Google). We process them to answer your request (Art. 6(1)(f) GDPR, and Art. 6(1)(c) for GDPR requests).

Recipients

These providers process data on our behalf:

• Cloudflare, Inc.: website hosting, statistics, Turnstile and email forwarding,
• Supabase, Inc.: the report database (servers in the EU),
• Resend, Inc.: sending emails,
• Google LLC: the mailbox (Gmail).

Where the law requires it, we pass vulnerability and incident reports, to the extent necessary, to the CSIRT and ENISA (Art. 14 of Regulation 2024/2847). We do not sell data or share it for advertising.

Transfers outside the EEA

Cloudflare, Supabase, Resend and Google are based in the United States and may process data outside the European Economic Area. Such transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

How long we keep data

• Reports from the form: while we handle the report and for 24 months after it is closed, in case the problem returns or for audits. After that we remove the email address and the IP hash.
• Email correspondence: as long as needed to deal with your request, and then as long as we may need to show that we did.
• Statistics: aggregated only, without data that identifies you.

Your rights

You have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format and object to processing based on our legitimate interest. Write to privacy@9dev.pl. We answer within one month.

You can also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in the country where you live.

Giving data in the form is voluntary, but we cannot handle a report without a description, or answer a request without an email address.

Changes to this policy

Every change to the content is a new version with a new effective date. The version and date are shown at the top of this page.