Legal
Privacy policy
What we collect, why, how long we keep it, and what you can do about it.
Last updated: TODO — date of the version you actually publish
The short version
We collect as little as we can and still run the site. There are no advertising trackers, no third-party analytics cookies, and nothing is sold or shared for marketing.
- Browsing the site requires no account and sets no tracking cookies.
- Joining the mailing list stores your email address and a record of your consent, until you unsubscribe.
- Creating an account stores your email address and whatever you choose to put in your profile.
- Downloading a package is recorded against your account, so we know which components are being used.
- You can export everything we hold about you, or delete your account, from your account page, without asking us.
Who is responsible
VIACERTO LLC is the controller of the personal data described here.
TODO — street and numberTODO — city, WA, postcodeUnited States
For anything in this policy, write to contact@viacerto.com.
What we collect, and why
| When | What | Why, and on what basis |
|---|---|---|
| You join the mailing list | Your email address, the exact wording of the consent you were shown, the time you gave it, your IP address and browser identification | To send you release announcements. Your consent. The record of what you agreed to and when exists so that consent can be demonstrated — you may withdraw it at any time using the unsubscribe link in any email. |
| You create an account | Your email address, and a display name and description if you choose to add them | To provide the account and the downloads you asked for. Needed to perform the agreement between us. There is no password: we email you a sign-in link instead, so we never hold a password of yours. |
| You sign in | A session record with your IP address, browser identification and timestamps | To keep you signed in, and to let you see and end sessions on other devices. Needed to perform the agreement, and our legitimate interest in account security. |
| You download a package | Which package and version, when, your IP address and browser identification, linked to your account | Our legitimate interest in knowing which components are in use, so that we can support them, tell you about updates that matter to you, and understand how our licence terms are being relied on. |
| You email us | Whatever your message contains | To reply to you. Our legitimate interest in answering correspondence. |
We do not make automated decisions about you, and we do not profile you.
Statistics
We count things, but not people. The site keeps aggregate daily counters — how many times a page was viewed, how many downloads happened, how many sign-ins completed. These counters contain no reference to any individual: no account, no session, no IP address, no device information. They are not personal data, which is why they do not appear in the table above.
We also use Vercel Web Analytics for referrer and traffic information. It sets no cookies and stores no persistent identifier for you, which is why this site has no cookie banner.
Web addresses reported to our own counters have their query strings removed before storage, because query strings sometimes carry personal data and we would rather not receive it.
Cookies
This site sets two cookies, both strictly necessary for it to work. Neither is used for advertising, tracking or analytics.
- A session cookie, set when you sign in, so the site knows it is you on your next request. It is removed when you sign out.
- A short-lived cookie remembering where you were heading when you were asked to sign in, so you can be returned there afterwards. It expires within thirty minutes.
Who else handles your data
We use the services below to run the site. Each is bound by a data processing agreement and may use your data only on our instructions.
| Service | What it does | Where |
|---|---|---|
| Vercel Inc.IP addresses in request logs; anything submitted through the site | Website hosting and server functions | Functions run in Frankfurt. Company established in the USA. |
| Neon Inc.Accounts, mailing-list records, download history | Database | Data stored in Frankfurt, EU. Company established in the USA. |
| ResendRecipient email addresses and message content | Sending email | EU sending region. Company established in the USA. |
| Cloudflare, Inc.IP addresses of people downloading files | Storage of downloadable files | Western Europe. Company established in the USA. |
| Google Ireland LimitedAnything you send us by email | Our own email inbox | EU |
We have deliberately chosen European locations for every service that stores your data. Several of these companies are established in the United States, so some transfer of data outside the EU can occur. Where it does, it takes place under the safeguards required by data protection law, such as standard contractual clauses.
We do not sell your data, and we do not share it for advertising.
How long we keep things
- Mailing list. Until you unsubscribe. The record of your consent is kept while you are subscribed and for a limited period afterwards, so that the subscription can be shown to have been legitimate.
- Account. Until you delete it.
- Sessions. Removed when you sign out, and expiring automatically after thirty days.
- Download records. Kept while your account exists. When you delete your account they are stripped of everything identifying you — the link to your account, your IP address and your browser identification are all removed — leaving only that a package was downloaded at a time. What remains is not personal data and is retained.
- Server logs containing IP addresses are kept by our hosting provider for a short period, for security and diagnostics.
Your rights
If you are in the EU or the UK, data protection law gives you the rights below. They apply whether or not you have an account, and exercising them costs nothing.
- Access — a copy of what we hold about you. With an account you can download this yourself, immediately, from your account page.
- Correction — of anything inaccurate. Your name and description are editable on your account page.
- Erasure — deletion of your data. You can delete your account yourself, from the same page.
- Withdrawing consent — the unsubscribe link at the bottom of every email, which works immediately and permanently.
- Objection — to processing we base on legitimate interests, including the download records.
- Restriction and portability — of your data.
The first three are built into the site rather than requiring you to ask us, because a right you have to request is a right with friction in front of it. For anything else, write to contact@viacerto.com and we will respond within one month.
Where we are, and complaints
VIACERTO LLC is established in the State of Washington, United States. We have deliberately chosen European locations to store your data, but as a company outside the EU we may access it from the United States. The United States has not been found by the European Commission to provide an equivalent level of data protection, which is why the safeguards described above are in place.
If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the data protection authority in your own country. Because we are not established in the EU, there is no single authority responsible for us; yours is the one to approach.
Changes
When this policy changes materially we will update the date at the top, and — if the change affects data you have already given us — tell subscribers by email before it takes effect.