Who runs Devdevian
Devdevian is an independent, open-source forum maintained by the Devdevian project, led by Tenyokj. The maintainers operate this hosted instance at devdevian.vercel.app. Other deployments of the open-source software are operated separately.
For privacy questions, access or deletion requests, contact dv842449@gmail.com. Please do not put personal records, passwords, verification codes, or security reports in public GitHub issues.
What we collect and why
We store your email, permanent username, display name, password hash when you register by email, and the profile information you choose to provide. This lets us create and secure your account and display your contributions. Passwords are hashed with a salt; we do not store your plain-text password.
We also store publications, replies, uploaded files, project and event details, attendance, community membership and join requests, votes, bookmarks, notification preferences, reports, and moderation decisions. These records support the features you use and help investigate abuse.
Google and GitHub provide an account identifier and verified email, together with basic profile information. Their access tokens are used during sign-in; the application does not store them for later access to your repositories, Gmail, or Google Drive.
Public and private spaces
Public-feed publications and public projects and events can be read by other visitors and may be copied or indexed by third parties. Files you attach to public publications are accessible with those publications. Public profile information and published profile images may also be visible to visitors.
Private-community conversations and their attachments are checked against membership on the server. Community owners and validators moderate their own spaces. Private does not mean end-to-end encrypted: authorized maintainers and infrastructure providers may need access to stored data to operate, troubleshoot, or secure the service.
Hiding your profile limits profile discovery; it does not make your existing public publications private. Event meeting links are restricted to attendees or the organizer.
Services that process information
The hosted service uses Vercel for hosting, Turso for application data, Supabase for uploaded files, and Brevo for verification emails. Sign-in through Google or GitHub also involves that provider. Google Fonts supplies the interface fonts, so a page visit makes requests to Google’s font servers.
These services receive the information needed for their role, such as your recipient email for a verification message, stored attachments, or network and request metadata. Provider processing and logs follow their own terms and retention practices and may involve locations outside your country.
Cookies and browser storage
Essential HTTP-only cookies keep you signed in and support switching between accounts on your device. Login and device cookies last up to seven days. Short-lived OAuth and account-linking cookies bind a sign-in request to the browser that started it.
Local storage remembers your theme and sidebar preference. The current application does not add advertising trackers or application analytics scripts. Hosting and service providers may still process operational logs, including network metadata, to deliver and protect their services.
Retention and account deletion
Account and contribution data is retained while needed to operate your account, preserve conversations, and handle moderation. Email confirmation codes expire after ten minutes and are stored as hashes, not readable codes. Expiry blocks use of a code; it does not promise immediate removal of every expired record or provider log.
You can request account deletion in Settings. The current deletion flow removes sign-in connections, sessions, membership, and profile details and replaces your identity with “Deleted member.” Contributions and some uploaded files can remain to preserve discussions. Account deletion is not a one-click erasure of every publication, attachment, report, backup, or provider log.
Community owners must transfer their communities before deleting their account. For removal of remaining personal content, a copy of your data, or questions about retained records, email the maintainers. We may need to verify that the request belongs to you.
Your choices and requests
You can edit optional profile information, notification preferences, and profile visibility; leave communities; cancel event attendance; and sign out. Your username remains permanent. Contact us to request access, correction, deletion, a data copy, or to raise an objection about how information is used. Available rights and exceptions depend on applicable law.
We do not sell personal data or use your verification email for a marketing newsletter. Verification messages are part of account security, rather than an optional notification category.
Security and reporting
The service uses HTTPS, server-side authorization, password hashing, short-lived verification challenges, and role checks for moderation. These are safeguards, not a guarantee that vulnerabilities cannot exist. Devdevian is in active development and has not received an independent security audit.
Report a suspected vulnerability privately to dv842449@gmail.com. Include a minimal reproduction using synthetic data. Avoid accessing other people’s records, disrupting the service, or publishing exploit details before maintainers can investigate. See the security policy.
Changes to this notice
We update this page when service practices change. The date above identifies this version. Material changes will be described here and, where appropriate, communicated through the service. Contact the maintainers if you need clarification before using a feature.