Privacy Policy

The short version

If you agree to it, I record how you found the site, which pages you read, and where you click - on my own server, never shared with anybody. If you say no, or simply do not answer, none of that happens. Nothing is recorded before you choose.

There is a second, separate box on the same banner, unticked: if you also tick it, I record a replay of your visit so I can watch where the site confuses people. Never what you type, and leaving it unticked changes nothing else.

Everything here runs from this domain. No advertising pixels, no tag manager, no embedded third-party content, and the fonts are served from here rather than from Google.

This page is split in two on purpose. What the site does today is described in detail and will change as the site does - so it carries a date, and it gets updated before the change ships rather than after. What I will never do is a separate list, and that one is a promise rather than a description.

If you do give me your email address or send me a project brief, I use it to reply to you or to send you the thing you asked for, and nothing else. I do not sell it, rent it, or share it for anyone else's marketing. Ever.

Who I am

This site is operated by Varner Ventures LLC, a limited liability company registered in South Carolina, United States, trading as CoderDude. For the purposes of the GDPR and the UK GDPR, that company is the data controller for the information described here.

Email: hello at coderdude dot com

Throughout this document "I" and "me" mean that company. It is one person, which is why it reads the way it does.

What I collect, and why

The weekly update and the community waitlist

One field: your email address. I use it to send the weekly build update and, if you joined the waitlist, to tell you when the community opens and what it costs before that is public. Every email has a working one-click unsubscribe, and unsubscribing removes you from the list rather than just muting you.

The contact form

Your name, your email address, the kind of build you are describing, the outcome you want, your rough timeline, and your budget range. I use it to decide whether the project is a fit, to reply to you, and to prepare for a consultation if we have one. If it is not a fit, I still reply.

The forms also carry a hidden field that real people never fill in. If it comes back filled, the submission is discarded as automated. Nothing about you is recorded in that check.

Server logs

Like every web server, the one hosting this site records a line for each request: your IP address, the page requested, the time, the referring page if there is one, and your browser's user-agent string. These are kept for security and debugging - working out whether something is broken or being attacked - and are not used to build a profile of you or combined with anything else.

What I will never do

These are not a description of how the site happens to be built this week. They are the lines I am committing not to cross, and if any of them ever changes it will not be quietly.

• Never sell, rent, or share your information for anybody else's marketing. Not as a business model, not as a favour, not as part of selling the business.
• Never record what you type. No keystroke logging, no capturing form contents as you fill them in - not even in a recorded visit, where every field shows as blank asterisks.
• Never record a replay of your visit unless you tick the separate box for it, which starts unticked.
• Never handle your card details. Eligible purchases use Stripe Managed Payments, whose merchant-of-record service is provided by Sold through Link, LLC. Payment details are submitted to Stripe and its associated services rather than stored on this server.
• Never track you across other people's websites. Nothing here follows you anywhere else, and nothing anywhere else reports back.
• Never measure you without asking first, and never make refusing harder than agreeing.
• Never ignore a Global Privacy Control signal from your browser.

What the site does today

This part changes, and the sections below spell it out: every cookie by name, everything recorded, every company that processes anything on my behalf. It is dated at the top of the page, and the rule I hold myself to is that it is updated before a change ships, not after somebody notices.

Right now that means no third-party analytics of any kind - no Google Analytics, no Plausible, no Fathom - and no advertising or conversion pixels. If I ever add one, it will be named here, and it will be behind the same consent as everything else.

Cookies and local storage

Five cookies at most, and I would rather list them than describe them. You can check this in your browser's developer tools in about ten seconds, and I would encourage it - a privacy policy is only worth what it can be checked against.

Two of them only exist after you say yes. Until you answer the banner, or if you answer no, the only cookies here are the two the site cannot work without.

coderdudecom-session

Keeps you signed in and keeps forms working across a page load. Strictly necessary: without it you could not log in or submit anything. Expires when the session does.

XSRF-TOKEN

Stops somebody else's website submitting a form to this one on your behalf. Strictly necessary, and a security measure rather than a tracking one.

cd_consent

Your answer to the banner - granted or denied, and nothing else. Without it I would have to ask again on every page. Lasts a year, and the "Cookie choice" link in the footer of any page clears it.

cd_recording

Your answer to the banner's second box, about recording a visit - granted or denied, and nothing else. It means nothing unless cd_consent says yes. Lasts a year, and "Cookie choice" clears it too.

cd_visitor

A random identifier for this browser. It is what lets me see that one person read three pages rather than three people reading one each, and it is what connects a visit today to a purchase next week. It contains a random value and nothing about you. Not strictly necessary - see below. Lasts a year.

The one that is not necessary

cd_visitor is analytics, and I am not going to pretend otherwise. It is set only if you agree, never before you answer, and never at all if you say no. It exists because I run this on my own and the difference between a video that brings buyers and one that brings nobody is the difference between spending next month building or spending it guessing.

It holds one random value and nothing about you. It is not shared, not sold, and not sent to any third party - the whole point of building this rather than installing something was that the data stops here.

You can refuse it by blocking cookies for this domain, or clear it any time by clearing site data for coderdude.com. Nothing on the site breaks if you do; I simply lose the ability to credit whatever brought you.

Changing your mind

Every page has a Cookie choice link in the footer. It clears your answer and asks again. Saying no is one click in the same place at the same size as saying yes - I am not going to make refusing the harder option.

If your browser sends Global Privacy Control, none of it runs at all. No cookie, no page records, no interaction records. That is checked on every request before anything is written, and you do not have to ask me for it - most browsers and privacy extensions can send that signal, and this site reads it.

Local storage

Two interface preferences, kept on your device and never transmitted:

cd:rot-paused

Whether you paused the rotating project list on the home page, so it stays paused on your next visit.

cd:builds-view

Whether you prefer the cards or the table layout on the builds page.

Both exist only because you clicked something and would reasonably expect the site to remember it. Clearing site data resets them and nothing else.

What I measure, and how

I built this rather than installing Google Analytics, so all of it runs on my own server and none of it is shared with anybody. That is the whole reason it exists: I need to know which video or post brings people who actually want what I make, and I would rather answer that myself than hand every visitor to a third party to find out.

Where you came from

On your first visit I record the link you followed, any campaign tags on the address, the page you landed on, your IP address and your browser's user agent. Once, on your first page, and never again for that browser.

Your IP address is personal data and I treat it as such. It is kept for rough location and to tell real visits from bots. It is never used to identify you by name, never matched against anything you have not deliberately given me, and never shared.

A note on search engines: they stopped sending search terms years ago. I can see that somebody arrived from Google. I cannot see what they typed, and neither can anyone else running a website.

Which pages you saw

Each page you open is recorded, in order, with the page you came from. That is how I learn that people reach the pricing page from the courses page and then leave - which tells me something is wrong with the pricing page.

Where you clicked

A small script records where you click, how far down a page you scroll, and a sampled trace of mouse movement - a position roughly three times a second while you are moving, capped so it cannot run away. Positions are stored as percentages of the page rather than pixels, so they mean the same thing on a phone and a desktop.

What it does not record: anything you type. No keystrokes, no form contents, no passwords, no card details. It knows that something at 46% across and 80% down was clicked, and what that thing was called. Nothing else.

Recording a visit

Under the same banner there is a second box: also record how I move around the pages. It starts unticked, it only counts together with a yes to the rest, and if you leave it unticked nothing in this section happens.

If you tick it, I also record a replay of the pages as you saw them: where the pointer went, what you clicked, how you scrolled, and how the page changed, so that I can play the visit back and see where the site is confusing.

It never records what you type: every form field is recorded as blank asterisks, the reply a form shows after you send it is hidden, your name and email address are hidden wherever the site shows them, and the account menu is left out entirely. Sign-in, password, account settings and billing pages are never recorded at all. It records nothing from other websites or other tabs. The recording is made by a program called rrweb that is served from this site, so it sends nothing to anybody else. Only I can watch a recording, and each one is deleted 365 days after the visit.

A Global Privacy Control or Do Not Track signal turns this off as well. To stop, use Cookie choice at the bottom of any page.

What it is joined to

If you later join the mailing list or buy something, the visit that first brought you is linked to it. That is the point of all of this: it lets me see that a particular video produced a customer, rather than guessing.

I do not see any of this in real time. I am one person reading aggregates, and the occasional recorded visit, after the fact.

What is never recorded

• Anything you type, anywhere, ever.
• My own visits - if I am signed in as an administrator, nothing is recorded at all.
• Anything from a browser sending Global Privacy Control.
• Anything shared with a third party, because there is no third party.

Lawful basis (GDPR / UK GDPR)

For anything I measure, the lawful basis is your consent. It is asked for by the banner before anything is recorded, stored as your answer, and withdrawable from the footer of every page. Nothing is measured before you answer, so there is no window where I am leaning on some other basis and hoping it holds up.

Withdrawing stops collection from that moment. It does not delete what was already recorded - ask me and I will, which is a right you have anyway and is set out below.

For the mailing list, the basis is also consent, given by confirming the address, and every message carries a one-click unsubscribe.

For a contact form or a purchase, the basis is performing a contract or taking steps at your request - you asked me something, or you bought something, and I cannot answer or deliver it without keeping the message and the address.

For security logs, the basis is legitimate interest: keeping the site standing and working out whether something is broken or being attacked. That is the ordinary running of a web server, and it is not used to build a profile.

Who else sees it

I do not sell your personal information, and I do not share it for anyone else's direct marketing. Under the CCPA/CPRA I have not sold or shared personal information in the preceding twelve months, and I do not intend to.

A small number of companies necessarily receive or process information to provide hosting, email delivery, and payment services:

• The hosting provider that runs the server and therefore holds the logs described above.
• An email delivery provider for the weekly update and for account mail: Postmark. They hold your address in order to deliver mail to it.
• Stripe Managed Payments, for eligible purchases. The merchant-of-record service is provided by Sold through Link, LLC, which acts as the merchant of record for transactions processed through Stripe Managed Payments and handles payment processing, applicable indirect tax obligations, disputes, and transaction support. Payment details are provided directly to Stripe and its associated services rather than stored on this server. I may receive transaction information needed to provide what you bought and to keep business records, such as your name, email address, product purchased, payment status, and related order details.

Beyond that, I will disclose information only where I am legally required to.

International transfers

I operate from the United States, so if you are in the UK or the EEA your information is transferred to and stored in the US. Where a provider handles that data, the transfer is covered by the UK/EU Standard Contractual Clauses or an equivalent approved mechanism in that provider's terms. You can ask me which provider handles what and I will tell you.

How long I keep it

• Mailing list addresses: until you unsubscribe or ask me to delete them, plus a minimal suppression record so that unsubscribing actually sticks and you are not re-added by a later import.
• Contact form submissions: up to 24 months, so I can pick up a conversation that went quiet. Longer if we go on to work together, because then it is part of the project record.
• Server logs: a rolling window of roughly 90 days, then overwritten.
• Your IP address and browser user agent: 30 days, then deleted from the record they are attached to. They are kept to tell a real visit from a bot and for a rough idea of where in the world people are, and both of those stop being answerable questions within days. Nothing else I store holds either — the rest is a random id and a page address.
• Which pages you saw: 24 months.
• Clicks, scrolling and mouse movement: 12 months. These are positions on a page layout, so they stop meaning anything once the page is redesigned.
• Recorded visits, if you ticked the second box: 365 days after the visit.
• Where you came from (the link you followed and any campaign tags on it): 24 months, or 5 years if it led to a purchase — in that case it has become part of the record of the sale, which I have to keep for tax reasons anyway. The IP and user agent are stripped out of it on the shorter schedule above either way.
• Monthly totals: indefinitely. Once the above are deleted what is left is counts — how many people opened a page in a given month, how many arrived from a given site. There is no id in it and nothing that could be traced back to you, and it is what lets me compare one year to another without keeping years of records about people.

These are deletions on a timer, not a policy I intend to follow. If you would rather not wait, ask me and I will remove what I hold about you now — see your rights.

Your rights

Wherever you are, you can ask me to show you what I hold about you, correct it, or delete it, and I will do it. You do not need to cite a regulation and you will not be treated any differently for asking.

If you are in the UK or the EEA, you specifically have the right to access, rectification, erasure, restriction of processing, objection to processing, and data portability, and the right to withdraw consent at any time. If you are in California, you have the right to know what is collected and why, to delete it, to correct it, and not to be discriminated against for exercising those rights.

Email hello at coderdude dot com and I will respond within 30 days. Realistically it will be a couple of days, because it is one person and a short list.

If you are in the UK or the EEA and you think I have handled this badly, you can complain to your national supervisory authority - in the UK, the Information Commissioner's Office. I would rather you told me first, but that is your call, not a condition.

Children

This site is not directed at children, and I do not knowingly collect personal information from anyone under 13. The mailing list and the contact form are meant for adults. If you believe a child has given me their information, email me and I will delete it.

Some of what I build is for children - Math Dungeon is a maths game aimed at kids. It is deliberately built so this question does not arise: no accounts, no cloud saves, no analytics on the player, and saves that never leave the device. The game does not send me anything about whoever is playing it.

Security

The site is served over HTTPS. Form submissions travel encrypted, and the small amount of data described here is held on access-controlled systems. No system is perfect and I am not going to claim otherwise, but there is very little here to lose. Account passwords are stored hashed, never as text, and I could not read yours if I wanted to. No card details are here at all, and no special category data.

Changes to this policy

The site is being built in public and it changes often, so this page will too. The date at the top is the only honest way to tell which version you are reading.

What I commit to: anything in "what I will never do" does not change without a message to the mailing list first, and a note here saying what changed and when. Everything else - a new cookie, a new processor, a new thing measured - is updated on this page before the change goes live rather than after.

That order matters more than the promise. A policy edited after the fact is a record of what already happened to somebody; edited first, it is a description they had the chance to read.

I have got this wrong twice while building the site. This page said it set no cookies while the login form was setting two, and it said nothing here took a payment on the day a checkout link went up. Both are fixed, and both now have automated checks that fail the build if the page and the code drift apart again. That is a better guarantee than my intentions.

How to reach me

hello at coderdude dot com for anything in this document, including access and deletion requests.

Varner Ventures LLC
South Carolina, United States