Privacy Policy

Last updated: October 11, 2026

This Privacy Policy describes how Devlio ("we," "us," or "our") collects, uses, stores, and protects your personal information when you use our platform.

1. Information We Collect

1.1 Information You Provide

  • Account Information: Username, email address, and encrypted/hashed passwords.
  • Profile Details: Display name, avatar, biography, social links, and communication preferences.
  • Creator & Asset Submissions: Uploaded digital files, documentation, version changelogs, screenshots, and licensing terms.
  • Support & Direct Inquiries: Communications submitted via our contact forms or support channels.

1.2 Information Collected Automatically

  • Usage & Analytics: Project views, download counts, search queries, and referring URLs.
  • Device & Network Data: Anonymized IP addresses, browser types, operating systems, and approximate country-level geographic regions.
  • Security & Session Logs: Login timestamps, security challenges, rate-limiting tokens, and CSRF authentication nonces.

1.3 Third-Party Authentication (OAuth)

If you sign in using Discord or Google OAuth, we receive only your public profile identifier, email address, and avatar as authorized by you. We do not access your private messages, contacts, or external credentials.

2. How We Use Your Information

We process personal information only for legitimate platform operations:

  • Providing access to digital downloads, purchases, and creator publishing tools.
  • Processing creator earnings and verified payout distributions.
  • Delivering important transactional emails (order receipts, security alerts, project status updates).
  • Enforcing platform security, fraud prevention, and automated multi-engine malware scanning.
  • Complying with statutory accounting and tax record-keeping requirements.

3. Data Sharing & Third Parties

We never sell, rent, or trade your personal data to third parties. Data is shared strictly with trusted infrastructure and payment partners:

  • Payment Gateways: Transactions are processed by PCI-DSS certified payment gateways (including Polar.sh and authorized regional payment channels). Devlio does not collect or store full credit card numbers or private payment credentials.
  • Malware & Threat Analysis: Uploaded files are scanned via VirusTotal API v3 to protect users from malicious payloads.
  • Bot Protection & CDN: Cloudflare Turnstile and CDN caching are utilized to prevent DDoS attacks and spam.
  • Advertising Partners: If enabled, Google AdSense may display non-personalized or contextual advertisements governed by Google's advertising privacy policies.
  • Legal Obligations: Information may be disclosed if required by lawful court orders, subpoenas, or to prevent imminent fraud.

4. Data Security & Storage

We apply defense-in-depth industry standards to protect your data:

  • High-cost cryptographic password hashing (bcrypt / Argon2).
  • Mandatory HTTPS / TLS 1.3 encryption for all data in transit with HSTS and strict Content Security Policies (CSP).
  • SQL injection defenses, automated parameterized queries, and CSRF token verification on all mutation requests.
  • Isolated file storage for creator uploads with hash verification (SHA-256).

5. Data Retention & Account Deletion

  • Active Accounts: Retained while your account remains active.
  • Account Deletion: You may request complete account deletion at any time via account settings or our contact form. Personal data is purged within 30 days, except records required for tax, audit, or active legal compliance.
  • Server Logs: Temporary connection and security logs are automatically rotated and purged after 90 days.

6. Your Data Rights (GDPR / CCPA)

Depending on your jurisdiction, you possess the following rights:

  • Right to Access: Request a complete copy of personal data stored in our systems.
  • Right to Rectification: Edit and update your personal data anytime via your profile settings.
  • Right to Erasure ("Right to be Forgotten"): Request immediate permanent deletion of your account and profile records.
  • Right to Restrict or Object: Opt out of non-essential communications or data processing.

7. Children's Privacy

Devlio is not intended for individuals under 13 years of age. We do not knowingly collect personal data from minors. Inquiries regarding minor accounts will be promptly addressed with account deletion.

8. Contact Us

For any privacy requests, data export inquiries, or regulatory questions, please reach out through our official Contact Page.