Privacy Policy

1. Overview

Vireo DevPulse (“DevPulse”, “we”, “us”) analyzes GitHub activity, quiz results, and profile settings to help developers understand and share their skill profile. This policy explains what data we collect, how we store it, and your rights under the GDPR and similar laws.

The service is operated by Timmie Hemmingsson, a sole trader in Sweden trading as Vireo, at Vistorp Kullen 1, 521 95 Kättilstorp, Sweden, reachable at support@aver-web.se. That person is the data controller for the personal data described here.

2. Data We Collect

• Account data: Email address and display name. If you sign in with GitHub or Google, these come from that provider (see “Sign-in providers and your GitHub token”).
• GitHub data: Public repository metadata, languages, contribution patterns, pull requests, issues, and your GitHub username — fetched via the GitHub API using your OAuth token.
• Quiz data: Your quiz answers, scores, proficiency levels, and session history.
• Job preferences and evidence journal: The roles, locations and preferences you enter, and the entries you add to your evidence journal.
• Usage analytics: Product events via PostHog (page views, feature use, conversion steps), linked to your account id once you are signed in — so they are pseudonymous, not anonymous. Collected only if you say yes when DevPulse asks; nothing is sent before that or after a no. While your yes stands, PostHog keeps an id in a first-party cookie and in local storage. No session recording, no repository contents, nothing you type.
• Crash reports (web only): Error reports via Sentry, including stack traces and browser information. Sentry is configured not to store IP addresses. The Android app sends none — it has no crash reporting SDK.
• Billing data: Subscription status and provider identifiers (Stripe or Google Play). We do not store full card numbers.
• Launch-note email address: If you ask for the launch note on our website, we store the address you enter, the project you asked about, your language, and where the request came from (the campaign parameters in the link you used). We send one confirmation email first; unconfirmed addresses are deleted after three days. Confirmed addresses are kept with our email provider, Resend, until you unsubscribe, which you can do from any email we send. Lawful basis: consent, withdrawable at any time.
• Portfolio data: Bio, theme selections, visibility settings, and public portfolio content.
• Feedback: What you write in the feedback form, with your account id. It is stored, and emailed to us through Resend so it gets read.
• IP address: Used for security and to count portfolio views; see “Security”.

3. Why We Use It, and on What Basis

• Your account, GitHub analysis, quizzes, skill profile, portfolio and subscription: performance of our contract with you (Art. 6(1)(b)).
• Accounting records of payments, and recording a withdrawal from a purchase: legal obligation (Art. 6(1)(c)): bokföringslagen (1999:1078) for the payment records, and distansavtalslagen (2005:59) 2 kap. 10 a §, which requires us to confirm without delay that we received your withdrawal.
• Usage analytics and the launch note: consent (Art. 6(1)(a)). You can withdraw it at any time — analytics in Settings, the launch note from any email — and withdrawing does not affect processing that happened before.
• Crash reports, security and abuse prevention, and handling feedback: legitimate interest (Art. 6(1)(f)): keeping the service working, keeping accounts safe, and fixing what you report.

An email address is required for an account; without it we cannot provide DevPulse. GitHub access is required for the GitHub analysis, and payment details only if you subscribe. Everything else — bio, portfolio, job preferences, analytics, feedback — is optional.

How the skill profile is made. Your skill profile is profiling in the GDPR’s sense: for each skill category we compute a score from your GitHub activity and one from your quiz answers. Where both exist the score is 60 % quiz and 40 % GitHub; otherwise the one source counts in full. We may compare it with score bands for other developers in the same role or country, and only when that group is large enough to stay anonymous. The profile is shown to you, and to others only on a portfolio you choose to publish. DevPulse makes no decision about you based solely on automated processing with legal or similarly significant effects (Art. 22).

4. Data Storage

Your data is stored in the following locations:

• Appwrite (self-hosted): Primary database and authentication for all user data, on our own server in Sweden.
• Cloudflare: Workers (website and API), KV (caching and short-lived counters), R2 (file storage).
• PostHog: Pseudonymous analytics events, with consent. Stored in Frankfurt, Germany.
• Sentry: Error reports and crash data from the website, stored in Frankfurt, Germany. Sentry is configured not to store IP addresses.
• Have I Been Pwned: When you choose a password, we check it against Have I Been Pwned’s list of passwords exposed in data breaches. The check is made from our server, and only the first five characters of a hash of the password are sent, never the password itself.
• Resend: Transactional email, feedback notifications and the launch-note list. Resend sends the mail from Ireland but keeps its records — account data, email metadata and logs — in the United States.
• Stripe: Billing records and payment identifiers. If you use the withdrawal form at /withdraw, the name and receipt email you enter, and when we received it, are recorded on your subscription at Stripe.
• Google Play: Android billing records and purchase tokens.
• Expo: Delivers updates to the Android app; it receives the device’s IP address and basic device information when the app checks for one.

5. Sign-in Providers and Your GitHub Token

Data we receive from sign-in providers. If you sign in with GitHub, GitHub sends us your email address, your name if your GitHub profile has one, and your GitHub account id. If you sign in with Google, Google sends your name, email address, profile picture and account id; the profile picture is not stored. In both cases Appwrite, our sign-in system, keeps the access token the provider issues, and a refresh token if it issues one, on its record of your sign-in. This data comes from the provider you chose, not from you, and is used to create and run your account and, for GitHub, to read your public repository data and GitHub username to build your skill profile (contract). GitHub and Google act under their own privacy policies.

GitHub OAuth tokens are stored encrypted in Appwrite and are never exposed to the browser or the mobile app. Only the Cloudflare Worker uses them, server-side, to fetch your repository data from the GitHub API. The token and your GitHub username are kept until you delete your account or GitHub is disconnected from it. When GitHub is disconnected, we delete the token, your GitHub username, your GitHub analysis and the cached copies of it; signing in with GitHub again reconnects it. You can also revoke DevPulse’s access at any time in your GitHub settings, which stops the token working at once.

6. Cookies and Storage on Your Device

DevPulse uses an Appwrite session cookie to keep you signed in, which is strictly necessary, and a cookie that remembers your language. Your answer to the analytics question is kept in your browser’s local storage so we do not ask again. The PostHog cookie and id are set only after you agree to analytics; when you withdraw, the id is reset and nothing more is sent, and a marker of your no stays so it keeps being respected. We use no third-party tracking cookies, advertising cookies or social-media pixels.

7. Your Rights (GDPR Articles 15–21)

• Access (Art. 15): You can request a copy of all the personal data we hold about you, using the address below, and the request is free. The portfolio editor exports your portfolio as JSON, but that is a product feature and covers only the portfolio — a copy of everything we hold comes from the address below.
• Erasure (Art. 17): Delete your account from settings. This deletes your data at once, including GitHub data and the cached copies of it, quiz results, portfolios, and billing records, except the transaction record described under “Data Retention”.
• Data portability (Art. 20): You can request your data in a structured, commonly used, machine-readable format (JSON), using the address below. This is free: Art. 12(5) says so, and we do not route it through a paid feature.
• Rectification (Art. 16): Update your profile, bio, and job preferences from settings.
• Restriction (Art. 18): You can ask us to restrict processing, for example while we check a correction you asked for.
• Withdrawing consent (Art. 7(3)): Turn analytics off in settings, or unsubscribe from the launch note. It takes effect immediately and does not affect processing before.

Your right to object (Art. 21). Where we rely on legitimate interest — crash reports, security, feedback handling — you can object at any time on grounds relating to your particular situation. We will then stop unless we can show compelling legitimate grounds that override your interests, or need the data for a legal claim.

To exercise any of these rights, contact support@aver-web.se or use the in-app account deletion feature. If you no longer have the app installed, request deletion here instead — that page lists exactly what is removed and what is not.

8. Data Retention

GitHub data is cached for 7 days and refreshed on each sync. Quiz results and skill profiles are retained for the lifetime of your account. Deleting your account removes your data immediately, except the transaction record Stripe and Google Play must keep under bokföringslagen (1999:1078) 7 kap. 2 §. A quiz question you submitted is deleted with the account if it has not been approved; an approved question stays in the question bank without your name. Analytics events are kept in PostHog for 12 months. Error reports are kept in Sentry for 30 days. Two copies of the database are made every night, each encrypted with a key only the owner holds: one on a second disk in the same machine (kept 14 days) and one with Cloudflare (R2) (kept 30 days). A restore was tested on 13 October 2026. So data you delete is gone from the backups within 30 days. Launch-note addresses: unconfirmed, three days; confirmed, until you unsubscribe. Portfolio-view counting keeps a visitor’s IP address with the portfolio id for 24 hours; sign-in and deletion-request counters keep it for at most an hour. Feedback is deleted 12 months after you send it: the stored copy and the email we received.

9. Security

Every request carries your IP address. We use it to limit sign-in attempts and account-deletion requests per address, and to count a public portfolio view only once per visitor per day. Lawful basis: legitimate interest in keeping accounts safe and view counts honest. Cloudflare, which carries the traffic, also processes the address to deliver and protect it; its logs of our API are kept for at most 7 days.

10. Data Sharing

We do not sell your data. Besides the providers in section 4, data reaches: GitHub, when we call its API with your token; Google and GitHub, when you sign in with them; and anyone who opens a portfolio you have made public.

Outside the EU. Our database runs in Sweden, but Cloudflare, Stripe, Sentry, PostHog, Resend, Expo, Google and GitHub are US companies, and part of what they handle is stored or reachable in the United States. Each of them is certified under the EU–US Data Privacy Framework, which the European Commission has found to give adequate protection (Decision (EU) 2023/1795); we checked the list at dataprivacyframework.gov on 10 October 2026. Where a transfer is not covered by that certification, it relies on the Commission’s Standard Contractual Clauses in the provider’s data processing terms. You can ask support@aver-web.se for a copy of these safeguards.

11. Billing

Billing data is processed by Stripe on web and Google Play on Android. DevPulse stores subscription status, provider identifiers, and billing event history for access control and auditability. We do not store full card numbers — Stripe and Google Play handle all payment processing securely.

12. Children

DevPulse is not directed at children under 13, and we do not knowingly create accounts for them, as the terms say. If you believe a child has an account, contact support@aver-web.se and we will delete it.

13. Changes

If this policy changes materially we will tell you by email before the change takes effect. The date at the top shows the current version.

14. Contact

For access, correction, export, deletion, or any privacy-related requests, contact support@aver-web.se.

If you believe your personal data is being handled unlawfully, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy.se.