Data should have a purpose. A purpose is not a license for surveillance.
DevHub uses the minimum data needed to authenticate accounts, publish and organize knowledge, maintain personal state, protect the service, and moderate. Public pages can be read without an account.
Scope and purpose
This policy describes the data processed when you use DevHub 404, including public reading, account actions, contributions, authentication, support, and security. We do not sell personal data or use reading activity for personal surveillance by default.
OAuth data from Google and GitHub
Google sign-in requests only the OpenID, email, and profile scopes. Google may return your provider identifier, email, verification status, name, and profile image. We use these data to authenticate you, find or create your DevHub account, link the provider, and populate basic profile information when applicable. We do not request access to Google Drive, Calendar, Contacts, or other Google services. GitHub sign-in requests read:user and user:email for the same authentication and account-identification purposes.
Account and authentication
Account data may include your email, provider identities, passkeys, MFA configuration, recovery information, sessions, and temporary proofs used to protect authentication flows. Your password is not sent to the DevHub server as a plaintext password. The browser stores only an opaque session identifier in a host-only HttpOnly cookie; bearer access tokens are not exposed to JavaScript.
Public profile
When you provide them, your username, name, avatar, bio, headline, location, links, profile tags, and eligible public contributions may appear on your public profile. A profile provides authorship and participation context; it is not a global reputation, seniority score, or developer ranking.
Content and contributions
Articles, Projects, Questions, Answers, Comments, Jobs, Events, News, Resources, suggestions, and related metadata are processed to publish, organize, preserve, moderate, and attribute content. Each content owner retains its own lifecycle and rules. Repository-based Codex, Cheatsheets, Roadmaps, and Tools are versioned editorial content and are not account-owned records.
Personal state and interactions
Bookmarks, followed Tags, notifications, and account-specific preferences are personal state used to provide the corresponding experience. Votes are associated with the voting Account while public totals may be shown. Views may be recorded for aggregate reach and discovery signals; individual views are not exposed as a public history.
Security, reports, and operations
IP address, user agent, session activity, authentication events, reports, feedback, and relevant evidence may be processed when needed for authentication, rate limiting, abuse prevention, incident response, moderation, auditing, and service reliability. Reports are claims for review, not public verdicts.
Cookies and browser storage
DevHub uses functional cookies for sessions and security. The client may keep preferences, caches, and other local interface state in browser memory, localStorage, or IndexedDB to make navigation faster and resilient. The server remains authoritative whenever local state is synchronized.
Service providers and external services
Data is shared only as needed to operate the requested capability. This may include Google or GitHub during OAuth, the configured email provider, Cloudflare Workers and Containers, PostgreSQL, Redis, object storage for media, and integrations explicitly used by the platform. External links and services remain controlled by their own operators. DevHub does not sell data or provide it for targeted advertising.
Retention
Retention depends on the purpose and owner of each record. Sessions have a 30-day lifetime unless revoked earlier. Temporary authentication proofs expire and are single-use when required. Abandoned media uploads are cleaned through scheduled workflows after the configured retention period. Public content, audit evidence, and historical references may remain when needed for continuity, safety, or accountability.
Account deletion
A deletion request places the Account in a pending state for 30 days. During that period, cancellation requires the verified recovery flow. After the retention period, each owner removes, anonymizes, or preserves the records required to maintain the integrity of its content and history. Deletion does not guarantee that every public structure or collective thread disappears.
Privacy requests
For questions or requests about access, correction, deletion, or the handling of your data, contact privacy@devhub404.org. Requests are evaluated according to the applicable context and the integrity requirements of public and collective content.
This page describes the platform’s operational practices and does not replace applicable legal obligations. For formal requests, visit the Contact page.
Security and privacy channels
For privacy requests, write to privacy@devhub404.org. For vulnerabilities and security incidents, use security@devhub404.org.
Responsible party
DevHub 404 is founded and developed by Júlio Pattuzzo.