—

LEGAL_DOC / PRIVACY

Privacy policy

Clear, honest, and transparent. Here's how we handle your information.

Last updated: August 24, 2026

Our Approach to Privacy

At Codewinks, LLC ("we," "our," or "us"), we believe privacy is a fundamental right, not a luxury. This Privacy Policy explains how we collect, use, share, and protect your information when you visit our website at codewinks.com and interact with our services.

We're a small software development company, which means we can be more thoughtful about data collection and more responsive to your privacy concerns. We only collect what we need, and we're transparent about what we do with it.

Information We Collect

Information You Provide

Contact Information: Name, email address, company name when you fill out our contact form
Project Details: Information about your project or inquiry that you share with us
Communication Records: Emails, messages, and other communications between us

Analytics Information

We use Plausible Analytics, a privacy-focused analytics tool that doesn't use cookies or track you across websites. We run it on our own infrastructure rather than using a hosted service, so this data is not handed to anyone else. It collects:

Page views and referrer information
General location (country/region level only)
Device type and browser information

Privacy Note: Because Plausible sets no cookies and builds no profile of you, there is no consent banner to click through. Running it ourselves means these numbers stay with us. Our analytics server is currently not running, so no visit data is being recorded at present. We are describing what the tool collects when it is on.

Technical Information

Server Logs: IP address, browser type, pages visited, timestamps
Error logs: when a page or the contact form fails, our server and the form's backend record what went wrong so we can fix it.
Security Information: Data needed to protect against spam and abuse

How We Use Your Information

Communication

→ Respond to your inquiries
→ Discuss potential projects
→ Provide customer support
→ Send project updates

Website Improvement

→ Analyze website performance
→ Understand user preferences
→ Fix technical issues
→ Improve user experience

Security & Legal

→ Prevent spam and abuse
→ Protect our services
→ Comply with legal obligations
→ Enforce our terms of service

Business Operations

→ Project planning and delivery
→ Invoice and payment processing
→ Contract management
→ Quality assurance

Information Sharing

What We Don't Do

✓ We never sell your personal information, and we do not share it for cross-context behavioural advertising
✓ We never share your data for advertising purposes
✓ We never give your information to data brokers
✓ We never use your data for marketing without consent

When We May Share Information

Service Providers

A small number of companies process data on our behalf, so the site can work and so we can run the business behind it. We name them rather than hiding them behind a generic clause:

Resend delivers the email when you submit the contact form. It handles your name, email address, company and message so that the message reaches us and so we can send you a confirmation.
Cloudflare serves the site, runs the bot check on the contact form, and routes the resulting email to our inbox. It processes your IP address and basic browser signals to tell a person from an automated submission, to limit how many times one address can submit, and to deliver your message to us.
Google hosts the inbox your message is delivered to, so it stores your name, email address, company and message for as long as we keep the message.
Stripe processes invoice payments for clients. It handles the billing name, email address and payment details needed to take a payment. This applies only if you hire us and we invoice you. Sending the contact form, or simply reading this site, never involves Stripe.

Each is bound by its own data processing terms. We do not sell your data to any of them, and none of them uses it for advertising.

Analytics are not on that list. We run Plausible ourselves, on our own infrastructure, rather than using their hosted service. No third party receives your page views at all.

Legal Requirements

When required by law, legal process, or to protect rights, property, or safety of Codewinks, our users, or others.

Business Transfers

In the unlikely event of a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.

With Your Consent

Any other sharing will only occur with your explicit consent and clear communication about the purpose.

Data Security

We implement industry-standard security measures to protect your information from unauthorized access, alteration, disclosure, or destruction.

Encryption

Traffic between your browser and this site is served over HTTPS.

Access Control

Limited access to personal information on a need-to-know basis only.

Monitoring

Our web server and the contact form's backend both write logs we can inspect when something goes wrong, and the server drops the common automated scanner requests without answering them. We are a small company and we do not run a formal audit programme, so we would rather describe what we have than imply more.

Security Disclaimer

While we implement strong security measures, no internet transmission is 100% secure. We cannot guarantee absolute security, but we work continuously to protect your information using current best practices.

Your Privacy Rights

You have several rights regarding your personal information. We respect these rights and make it easy for you to exercise them.

Access & Portability

→ Request a copy of your personal information
→ Ask about how your data is being used
→ Get your data in a portable format

Correction & Updates

→ Correct inaccurate information
→ Update your contact details
→ Complete incomplete information

Deletion & Erasure

→ Request deletion of your personal information
→ Object to how we are processing it

Processing Control

→ Ask us to restrict processing while we look into a concern

How to Exercise Your Rights

To exercise any of these rights, simply contact us at:

[email protected]

We'll respond to your request within 30 days and verify your identity before processing any requests involving personal information.

Cookies and Tracking

Good News About Cookies

We use Plausible Analytics, which doesn't use cookies or track users across websites. This means you won't see annoying cookie consent banners, and your browsing behavior isn't being tracked for advertising purposes.

What We Do Use

Essential Functionality

None of our own. This site sets no cookies and saves nothing in your browser. There is no login, no cart, and no saved preferences to keep. Cloudflare, which sits in front of the site and runs the bot check, may set its own short-lived cookies; those are described just below.

The Contact Form Bot Check

The contact form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. It does not track you across sites or build a profile, but it may set a short-lived cookie to remember that a check has already passed. It loads on the home page, which is where the contact form lives, and nowhere else on the site.

Privacy-First Analytics

Plausible Analytics for understanding website usage without compromising your privacy or using cookies.

Do Not Track

Some browsers send a Do Not Track signal. There is no agreed standard for what a site should do with it, so we do not respond to it. We mention this because California law asks us to say either way. It makes no practical difference here, because we do not track you in the first place.

Tracking Across Other Sites

No third party collects information about what you do on this site over time or across other websites. Plausible records the visit details listed further up this page and stops there. We run no advertising, no remarketing, and no social media pixels.

Third-Party Services

Our website may contain links to third-party websites or services. These have their own privacy policies, and we're not responsible for their practices. We encourage you to review their privacy policies before providing any personal information.

Data Retention

We only keep your personal information as long as necessary for the purposes outlined in this policy or as required by law.

Contact Inquiries

We aim to clear out contact inquiries after about three years. This is a review we do by hand, not an automated deletion, so treat it as our practice rather than a guarantee. Ask us and we will delete yours sooner.

Client Projects

Retained for 7 years

To meet legal requirements and provide ongoing support

Analytics Data

Aggregate visit counts, kept on our own server. They contain no account and no profile, and we clear them out when they stop being useful to us.

Server Logs

Kept only in the running web server and replaced whenever the site is redeployed. They record an IP address, the page requested, a timestamp, the page you arrived from, and the browser your request identified itself as. They are used for diagnosing faults and abuse, and we do not archive them or analyse them for anything else.

Bot Check Counter

Deleted automatically within one hour. To stop the contact form being flooded, we count recent submissions against your IP address. That counter expires on its own an hour after your most recent submission and is the only thing on our side that deletes itself on a timer.

How Deletion Actually Works

The periods above are how long we keep things, not an automated job. We review and clear out old material rather than running a script, and we would rather say that plainly than claim an automation we have not built. If you want your information deleted sooner, ask us and we will do it.

International Users

Codewinks, LLC is based in the United States, and that is where your message reaches us. The site itself is served from Cloudflare's global network, so the page and the contact form's bot check run at a location near you rather than in one country. Our analytics run on our own infrastructure rather than a hosted service, so page-view data does not leave our control or travel to a separate analytics company.

EU and UK Users (GDPR)

Codewinks, LLC is the data controller for everything described on this page. Contact us at [email protected].

Why We Are Allowed to Process Your Data

The law requires us to name a lawful basis for each thing we do, rather than assert compliance in general terms:

Your message. Legitimate interest: you wrote to us and we would like to write back. If you are asking about a project, we also rely on taking steps at your request before entering a contract.
The bot check and submission limit. Legitimate interest: keeping the contact form usable by preventing automated abuse. This is why we process an IP address. The submission counter that holds it expires within an hour. Your IP also appears in our web server's request log, which is discarded when the site is redeployed, and in Cloudflare's own logs, which they keep under their retention terms.
Analytics. Legitimate interest: understanding roughly how many people visit. Plausible sets no cookies, builds no profile, and cannot identify you.

We do not rely on consent for any of this, which is why there is no consent banner. The only automated decision anywhere on this site is whether a contact form submission looks like a person or a script. Nothing is decided about you personally, and nothing has a legal effect on you.

Exercising Your Rights

The rights listed above (access, correction, deletion, restriction, portability, and objection) apply to you. Email us and we will respond within one month, which is the period the regulation allows. We will not charge you and we will not make it difficult.

Complaints

If we get it wrong, you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EU it is the supervisory authority for the country you live in. We would rather you told us first so we can fix it, but that is your choice, not a condition.

Canadian Users (PIPEDA)

The access, correction, and deletion rights described above apply to you on the same terms, through the same email address. If you are not satisfied with our response, you can raise it with the Office of the Privacy Commissioner of Canada.

Children's Privacy

Our website and services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that we have collected personal information from a child under 13, we will promptly delete such information from our records.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected].

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

How We'll Notify You

We update the date at the top of this page. We do not keep a mailing list for visitors, so we have no way to email you, and we are not going to promise a notice we cannot send. If you have an active project with us, material changes reach you through your project agreement instead.

Your Options

→ Contact us with questions or concerns
→ Exercise your privacy rights under the updated policy

Continued Use

Your continued use of our website after changes become effective constitutes acceptance of the updated Privacy Policy.

Contact Us

We take your privacy seriously and are here to answer any questions or address concerns you may have about this Privacy Policy or our data practices.

General Privacy Questions