Privacy Policy

1. Who we are

SEFADEV is a publishing platform where developers write posts, showcase work, and keep a portfolio at a durable public address. This policy explains what personal data we handle when you use it.

SEFADEV is operated by SEFADEV, which is the data controller for the personal data described here. You can reach us at privacy@sefadev.com about anything in this document.

2. The one thing to understand first

SEFADEV is a public publishing platform, and the public parts of it are deliberately built to be found and quoted. Your profile, your posts and your comments are readable by anyone without an account. We actively invite search engines and AI answer engines to crawl, index and cite them — our robots.txt names crawlers from Google, Microsoft, OpenAI, Anthropic, Perplexity, Apple, Meta, Amazon and others and grants each of them access to every public page, and our sitemap.xml submits those pages to them.

That is the product, not an accident: the point of publishing here is that your work is surfaced and attributed to you. But it has a consequence you should choose knowingly — anything you publish may be copied into search indexes and AI training or answer systems that we do not control and cannot retract on your behalf. Deleting a post removes it from SEFADEV; it does not remove it from a third party’s cache or model. Do not publish anything here that you would not want permanently public.

Everything else — your email address, your password, your drafts, your notification settings, your telemetry — is not public and is handled as described below.

3. What we collect

We do not ask for, and have no way to receive, your date of birth, phone number, physical address or payment details. SEFADEV does not process payments.

4. Google sign-in

If you sign in with Google, we request only these OAuth scopes: openid, profile and email. From those we receive your Google account identifier, your name, your profile picture URL and your email address — and nothing else. We do not request, and cannot access, your Gmail, Google Drive, Contacts, Calendar or any other Google service.

Limited Use. SEFADEV’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we use Google user data only to provide and improve SEFADEV’s user-facing features; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and we do not allow humans to read it except with your explicit consent, where it is necessary for security purposes or to comply with applicable law, or where the data is aggregated and de-identified.

You can disconnect SEFADEV from your Google account at any time from your Google account permissions page. Doing so stops future sign-ins; it does not delete your SEFADEV account — for that, see §9.

5. Usage telemetry, and its limits

We record a small set of events as people read: that a post was shown, opened, read to the end, liked, saved, shared, followed or searched for. We use this to decide what to show in feeds, and to measure whether the platform is actually being surfaced by search engines and AI assistants — the thing SEFADEV exists to do.

The constraints on that data are deliberate and worth stating plainly:

• We do not store IP addresses in our analytics. No column for one exists.
• We do not record where you came from in full. Referrers are reduced, at the moment of writing, to a bare hostname and a category (“AI”, “search”, “social”, “direct”). The full referring URL, including any query string, is discarded and never written down.
• The session identifier is ephemeral. It is a random string held in your browser’s sessionStorage — not a cookie, not persisted across visits, and never linked to your account. It exists only so that an “opened” and a “finished reading” a moment later can be recognised as the same visit.
• Raw telemetry expires. It is deleted after 90 days. What survives is a per-post aggregate that contains no identity.
• None of it is ever shown publicly. SEFADEV has no vote counts, no karma, no view counters and no trending scores, by design. These numbers are an internal ranking input and are never rendered on a page or returned by a public API.
• We use no third-party analytics or advertising trackers. No Google Analytics, no advertising pixels, no cross-site tracking, no data brokers.

Declared search and AI crawlers are excluded from these counts. If your browser blocks the request, or you have JavaScript disabled, every page still works exactly the same — nothing on SEFADEV depends on telemetry reaching us.

6. Cookies

SEFADEV sets two cookies, both strictly necessary: an access token and a refresh token, which together keep you signed in. Both are HttpOnly (unreadable by JavaScript), SameSite=Lax, and Secure in production. The refresh cookie lasts up to 30 days; signing out clears both.

We set no advertising, profiling or analytics cookies, which is why you are not being asked to dismiss a consent banner. If you are signed out, SEFADEV sets no cookies at all.

7. Images you upload

Photographs commonly carry hidden metadata — most importantly GPS coordinates recording where the picture was taken, plus device serial numbers and timestamps. We strip that metadata from every image before it is published. The scrub happens on our servers, at upload, and it fails closed: an image that cannot be scrubbed is rejected rather than published.

The stripping is lossless — we rewrite the file container rather than re-encoding, so your image is not silently degraded. Camera orientation is the single tag preserved, so portrait photos are not published sideways.

8. Email we send you

We divide email into two kinds and treat them differently:

• Transactional — address verification, password resets, and confirmation of an email change. These are not marketing and cannot be unsubscribed from: you cannot opt out of being able to recover your own account. When you change your email address we also notify the old address, so that an unauthorised change reaches an inbox you still control.
• Notifications — someone replied to your post, or mentioned you. Every one carries a one-click unsubscribe header and an unsubscribe link, and we check your preferences before each send. We never send a notification to an address that has not been verified.

We do not send marketing email, digests of popular posts, streak reminders or “your post is trending” nudges. We do not sell or rent your email address, ever.

9. How long we keep things, and deleting your account

Account data is kept while your account exists. Raw telemetry is deleted after 90 days regardless. Expired and revoked session tokens are cleared automatically.

You can delete your account from your account settings, or by writing to privacy@sefadev.com. When you do:

• Your identity is erased — your name, email address, avatar, provider linkage and password hash are deleted, and your telemetry is deleted with them.
• Your username is released, and your profile and posts come down.
• Comments you left on other people’s posts remain, with your name removed. This is deliberate: deleting them would tear holes in discussions that other people wrote and still own. If you need a specific comment removed as well, ask us and we will remove it.

Backups roll off on their own schedule, so a short window may pass before deleted data disappears from them. We may also retain the minimum needed to comply with a legal obligation or to resolve a dispute.

10. Who else touches your data

We do not sell personal data and we do not share it for advertising. We use these service providers to run the platform:

Each processes data only to provide its service to us. We may also disclose data where we are legally required to, or where it is necessary to investigate abuse or protect someone’s safety.

These providers operate globally, so your data may be processed outside your country. Where the law requires a transfer safeguard, we rely on the providers’ standard contractual clauses.

11. Your rights

Depending on where you live you have some or all of these rights. We honour them for everyone rather than checking your jurisdiction first:

• Access — get a copy of the data we hold about you.
• Correction — most of it you can edit yourself in settings.
• Deletion — see §9.
• Portability — get your posts and profile in a machine-readable form.
• Objection and restriction — tell us to stop a particular use.
• Withdrawing consent — for anything you opted into, such as notifications.

Write to privacy@sefadev.com and we will respond within 30 days. If you are in the EU or UK and are not satisfied with our answer, you may complain to your local data-protection authority.

12. Why we are allowed to do this

For readers under the GDPR or a similar regime, our legal bases are:

• Performance of a contract — running your account, publishing what you write, and sending transactional email.
• Legitimate interests — keeping the platform secure, preventing abuse, and the aggregate measurement described in §5, which is deliberately built without identifiers or IP addresses so that it stays proportionate.
• Consent — notification email and mobile push, which you turn on and can turn off.
• Legal obligation — where we must retain or disclose something.

13. Security

Traffic is encrypted in transit. Passwords are stored only as salted hashes, and refresh tokens only as SHA-256 digests, so a database disclosure does not hand over either. Session cookies are HttpOnly and cannot be read by scripts. No system is perfectly secure; if we discover a breach affecting your personal data we will notify you and the relevant authority as required by law.

If you find a vulnerability, please report it to abuse@sefadev.com rather than disclosing it publicly, and we will work with you on it.

14. Children

SEFADEV is not intended for anyone under 13, and we do not knowingly collect data from children. If you believe a child has created an account, tell us at privacy@sefadev.com and we will delete it.

15. Changes to this policy

We will update this page when the platform changes, and we will move the “last updated” date at the top. If a change materially reduces your privacy we will tell you by email or an in-app notice before it takes effect, rather than relying on you re-reading this page.

16. Contact

Privacy, data access and deletion: privacy@sefadev.com.
General support: support@sefadev.com.
Abuse, security and copyright: abuse@sefadev.com.

See also our Terms of Service.