Skip to content

Legal

Privacy Policy

Effective from

1. Identity of the Data Controller

This Privacy Policy applies to our websites codingshadows.com and codingshadows.ro (the "Websites") and to the CodingShadows mobile and web applications that link to it (each an "App"; the Websites and the Apps together, the "Services"). The operator of the Services and the Data Controller responsible for your personal data is:

  • Legal name: RUSU D. DINU-ȘTEFAN PERSOANĂ FIZICĂ AUTORIZATĂ, trading as CodingShadows
  • Fiscal Registration Code (CUI): 50977819 (VAT code RO50977819)
  • Trade Register Number: F2024017646002
  • Country: Romania
  • Email for Data Privacy Inquiries: contact@codingshadows.com

The controller's registration details are public and can be obtained from the Romanian Trade Register (Oficiul Național al Registrului Comerțului, ONRC).

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Romanian Law No. 190/2018.

Sections 2 to 5 describe how the Apps process personal data. Sections 8 and 9 add the practices specific to the Drivers Data and Listuță apps. Section 10 describes the processing that takes place when you visit the Websites. Sections 6 and 7 (your rights and the supervisory authority) apply to all Services.

2. Categories of Data We Collect and Processing Purposes

We process personal data to provide, maintain, and improve our Apps. The data collected is categorized as follows:

2.1 Automatically Collected Technical Data

When you use our Apps, we collect certain technical information via Google Firebase and Google Play Services.

  • Data Points: IP Address (processed ephemerally for geolocation then discarded), Mobile Device IDs (Android Advertising ID / iOS IDFA), App Instance IDs, device model, operating system version, and mobile carrier.
  • Purpose: To analyze app performance, maintain stability, and understand regional usage trends. If you are signed in and have accepted analytics, a pseudonymous account identifier (never your email or name) is also attached to these analytics events, and it is removed when you sign out or withdraw consent.
  • Legal Basis, Consent (Art. 6(1)(a)): For Analytics identifiers and Advertising IDs. You will be asked for permission upon first launching the app.
  • Legal Basis, Legitimate Interest (Art. 6(1)(f)): For strictly necessary technical diagnostics (Crashlytics) to prevent app crashes and ensure security.

2.2 User-Generated Content and AI Interactions

Some of our Apps allow you to interact with Artificial Intelligence models.

  • Data Points: Text prompts, images, or audio recordings you submit to the AI; the generated responses (completions); metadata associated with your request (timestamps, tokens used); and chat conversation history.
  • Purpose: To provide the generative AI features requested by you (e.g., answering questions, creating content) and to maintain context for ongoing conversations.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)), we cannot perform the service of generating content without processing your input.

2.3 Diagnostic and Crash Data

In the event of an error, we collect crash reports via Firebase Crashlytics.

  • Data Points: Installation UUID (a random number identifying the installation), stack traces (code status at the time of crash), and device state (battery level, free storage).
  • Purpose: To identify, reproduce, and fix software defects.
  • Legal Basis: Legitimate Interest (Art. 6(1)(f)). We have a legitimate interest in ensuring the stability and security of our Apps. This data is retained for 90 days.

3. Artificial Intelligence and Data Processing

We utilize advanced AI technologies provided by Google Cloud Vertex AI and OpenRouter.

3.1 No Training on User Data

We value your intellectual property and privacy.

  • Google Vertex AI: We utilize enterprise-grade instances of Google's AI models. According to our agreements with Google, your inputs (prompts) and outputs are not used to train Google's foundation models that are shared with other customers.
  • OpenRouter: We configure our routing to prioritize "Zero Data Retention" providers. This means your data is processed transiently to generate a response and is not stored by the AI provider for model training purposes.

3.2 Automated Decision Making

The AI features in our Apps assist you in generating content or obtaining information. The Apps do not make decisions based solely on automated processing that produce legal effects concerning you (such as credit scoring, employment eligibility, or legal profiling).

4. Data Recipients and International Transfers

To operate the Apps, we share data with the following third-party service providers ("Processors"):

Hetzner Online GmbH

  • Role & Location: Cloud Infrastructure & Hosting (Germany/Finland)
  • Safeguards for Transfer: Data Processing Agreement (DPA) and hosting within the EU (GDPR compliant).

Google Ireland Limited / Google LLC

  • Role & Location: Cloud Infrastructure, Analytics, AI Services (USA/EU)
  • Safeguards for Transfer: EU-U.S. Data Privacy Framework (Adequacy Decision) and Standard Contractual Clauses (SCCs).

OpenRouter (OpenRouter, Inc.)

  • Role & Location: AI Model Gateway (USA)
  • Safeguards for Transfer: Standard Contractual Clauses (SCCs).

Sub-processors via OpenRouter

  • Role & Location: AI Model Providers (e.g., Anthropic, OpenAI)
  • Safeguards for Transfer: Data is routed based on user selection; safeguarded by OpenRouter's data processing agreements.

RevenueCat, Inc.

  • Role & Location: In-app subscription management (USA)
  • Safeguards for Transfer: Standard Contractual Clauses (SCCs).

Stripe Payments Europe, Ltd. / Stripe, Inc.

  • Role & Location: Web payment processing (Ireland/USA)
  • Safeguards for Transfer: EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).

International Transfers: Your data may be transferred to the United States. We rely on the EU-U.S. Data Privacy Framework for transfers to Google. For other transfers, we implement Standard Contractual Clauses approved by the European Commission to ensure your data remains protected to GDPR standards.

The recipients involved when you visit the Websites are listed in section 10.

5. Data Retention

We retain your personal data only for as long as necessary:

  • Crash Reports: Deleted automatically after 90 days.
  • Analytics Data: Retained for 14 months (or 2 months, depending on user settings) to allow for year-over-year analysis, then automatically deleted.
  • AI Inputs: We store your chat prompts and conversation history on our servers to allow you to review past conversations and maintain context. This data is retained until you delete it or your account.
  • User Account Data: Retained until you request deletion of your account.

6. Your Rights under GDPR

You have the following rights regarding your personal data:

  • Right to Withdraw Consent: You may withdraw your consent for Analytics or Ads at any time via the app settings.
  • Right of Access: You can request a copy of the data we hold about you.
  • Right to Erasure ("Right to be Forgotten"): You may request the deletion of your account and all associated data. Note that for crash reports, linked via Installation UUID but otherwise anonymous, usually expire automatically after 90 days. If you can provide the UUID, we can manually delete them sooner.
  • Right to Rectification: You can correct inaccurate personal data.
  • Right to Object: You have the right to object to processing based on legitimate interest.
  • Right to Portability: You may request your data in a structured, machine-readable format.

To exercise these rights, please contact us at: contact@codingshadows.com. We will respond to your request within 30 days.

7. Competent Supervisory Authority

If you believe your rights have been violated, you have the right to lodge a complaint with the Romanian Supervisory Authority:

  • Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
  • Website: www.dataprotection.ro
  • Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, cod poștal 010336, București, Romania.

8. Drivers Data App: Additional Processors and Data Practices

The Drivers Data mobile and web application (a virtual logbook for professional drivers) uses the following additional third party services and processes the following categories of data, on top of the general practices described above.

8.1 Firebase Crashlytics and Firebase Performance Monitoring

  • Provider: Google Ireland Limited / Google LLC.
  • Data Points: crash and error reports, stack traces, device state, and app performance metrics such as startup time and network latency.
  • Purpose: to detect, diagnose, and fix crashes and performance issues.
  • Legal Basis: Legitimate Interest (Art. 6(1)(f)); retained as described in section 5.

8.2 Firebase Analytics

  • Provider: Google Ireland Limited / Google LLC.
  • Data Points: in app usage events (screens viewed, features used), the installed app version, and device / App Instance identifiers, and, for signed-in users who accepted analytics, a pseudonymous account identifier (never an email or name).
  • Purpose: to understand how the app is used and to prioritize improvements.
  • Legal Basis: Consent (Art. 6(1)(a)), requested on first launch.

8.3 Firebase Cloud Messaging

  • Provider: Google Ireland Limited / Google LLC.
  • Data Points: a device push token used to deliver notifications, for example reminders and support replies.
  • Purpose: to deliver push notifications.
  • Legal Basis: Legitimate Interest (Art. 6(1)(f)); the token is removed when you sign out or delete your account.

8.4 Crisp (In App Support Chat)

  • Provider: Crisp IM SAS (France).
  • Data Points: your email address and display name, shared with Crisp to open a support conversation, plus the content of the messages you send us.
  • Purpose: to provide in app customer support.
  • Legal Basis: Legitimate Interest (Art. 6(1)(f)) and, where you start a conversation, Contractual Necessity (Art. 6(1)(b)).
  • Safeguards for Transfer: Data Processing Agreement; Crisp is an EU based company.

8.5 RevenueCat (Subscription Management)

  • Provider: RevenueCat, Inc. (USA).
  • Data Points: subscription and entitlement status, and store receipt / transaction identifiers from Google Play or the App Store. We do not collect or store your card details; payments are processed entirely by the app store.
  • Purpose: to verify and manage your subscription across devices.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)).
  • Safeguards for Transfer: Standard Contractual Clauses (SCCs).

8.6 Route Sheet Photos and Other Uploaded Attachments

If you attach photos of route sheets or other documents to a logged work day, these files are uploaded through our own backend and stored on Hetzner Online GmbH object storage within the EU (see section 4).

  • Access: only you, and CodingShadows administrators handling a support request you raised, can access these files. They are never used for analytics, advertising, or AI training.
  • Retention and Deletion: an attachment is deleted when you remove it from within the app, and all of your attachments are deleted when you delete your account. Files that become orphaned, for example when an upload is interrupted, are automatically removed after 7 days.

8.7 Data Export

Before deleting your account, you can download a full copy of your data (work day records, profile, and uploaded attachments) from Profile in the app. This supports your Right to Portability under section 6.

8.8 Account Deletion

You can delete your Drivers Data account directly in the app, from Profile. If you cannot access the app, email contact@codingshadows.com with the subject "Delete my Drivers Data account" from the address linked to your account. Your sign in access is removed immediately; your account, work records, and uploaded route sheet photos are deleted within 30 days of the request. Instructions are also published at https://driversdata.codingshadows.com/delete-account.html.

8.9 Roster Import from a Photo or PDF (Pro Feature)

If you import your monthly depot roster from a photo or a PDF, the file is sent through our backend and our own AI gateway, both hosted on Hetzner Online GmbH infrastructure within the EU (see section 4), to an AI model that reads your row of the roster. Rosters imported from an Excel file are read without any AI model and are not covered by this subsection.

  • Provider: Anthropic, PBC (USA). OpenAI, L.L.C. (USA) may be used for this feature instead; the import screen in the app names both. The request goes to the provider directly, not through OpenRouter.
  • Data Points: the photo or PDF you upload, which usually lists the service numbers and planned shifts of other drivers at your depot as well as your own, and the service number you ask us to find. We do not send your name, email address, or account identifier to the provider.
  • Purpose: to read your planned shifts for the month so you do not have to type them, and to compare them with what you record.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)) for your own data. The other rows of the document are processed only as far as needed to find yours, on the basis of Legitimate Interest (Art. 6(1)(f)).
  • Retention: our AI gateway keeps the uploaded file and the model's answer for up to 60 days, for troubleshooting and quality checks, and then deletes them; only the administrator of CodingShadows can access them. Rows read from a roster may additionally be kept for up to 60 days after the end of the month the roster covers, so that a colleague who uploads the identical file gets an answer without a new AI call. These rows are stored under a keyed cryptographic hash of each service number, not under the number itself, and only the row matching the uploader's own service number is ever returned.
  • Safeguards for Transfer: Standard Contractual Clauses (SCCs).

8.10 Voice Entry (Pro Feature)

Voice entry lets you dictate a work day after your shift instead of typing it.

  • Recording: while you hold the dictate button, or between starting and stopping the microphone, the app records what you say (at most 60 seconds) and sends the recording to our backend. The app keeps no copy on your phone. Older versions of the app instead turned your speech into text with the speech recognition service of your phone (Apple Inc. on iOS, Google LLC on Android) and sent only that text.
  • Provider for Audio and Text Processing: Google Ireland Limited / Google LLC (Gemini models), reached through our backend and our own AI gateway hosted within the EU. The model first writes down what was said in the recording, then reads the day's fields from that text.
  • Data Points: the recording (your voice and anything audible around you while it records), or the text you type instead, and the date of the day you are dictating. We do not send your name, email address, or account identifier to the provider. Fields you did not mention may be filled from your own earlier logbook entries; this is done on our servers, without an AI model.
  • Purpose: to fill in the day's form for you to check. Nothing is saved to your logbook until you review the fields and save the day yourself.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)).
  • Retention: our AI gateway keeps the recording, the text written down from it and the model's answers for 60 days, for troubleshooting and quality checks, and then deletes them; only the administrator of CodingShadows can access them. Our backend itself stores none of them.
  • Safeguards for Transfer: EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs).

8.11 Usage Records for AI Features

For each use of the features in 8.9 and 8.10 our AI gateway records a pseudonymous account identifier (never your email or name), the app version, and the cost of the request, in order to enforce usage limits and control spending. The account identifier is removed from these records after 60 days. A daily count of how many times your account used each feature is kept for 7 days to enforce the daily limit, and is deleted when you delete your account. We do not use your uploads, your recordings, your dictated text, or the answers to train any AI model.

9. Listuță App: Optional Account and the Listuță Family Subscription

You can use Listuță (the shopping list app) without an account. Lists are shared by share code, and sharing never needs an account. If you choose to create an account and sign in, we process the following.

  • Sign-in Provider: our own sign-in service at auth.codingshadows.com (Keycloak), hosted on Hetzner Online GmbH infrastructure within the EU. No third party receives your sign-in details.
  • Data Points: your email address, the name you chose (if any), your password (stored only as a salted hash by the sign-in service), and an account identifier. Linked to that identifier we store your list index: for each list you saved, its share code, name, icon, colour, when you added it and last opened it, and how you sort your lists.
  • Purpose: so that your lists appear on your other phones and on app.lista-cumparaturi.ro after you sign in there. The lists themselves are not tied to your account and stay reachable by their share code.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)).
  • Retention: until you delete your account. Removing a list from your index keeps a marker of that removal, without the list's contents, so another device does not bring the list back. Signing out keeps your lists on the device and stops syncing.
  • Deletion: you can delete your account at any time in the app (Settings, then Account, then Delete account) or on app.lista-cumparaturi.ro. This deletes the account and its list index, not the lists. If you cannot access the app, email contact@codingshadows.com with the subject "Delete my Listuță account" from the address you signed in with.

9.1 Listuță Family: the Subscription

The "Listuță pentru familie" subscription is bought in the app (App Store or Google Play) or on app.lista-cumparaturi.ro and needs an account. Its list features are available to everyone who uses a list saved by a subscribed account, without them needing an account.

  • Provider: RevenueCat, Inc. (USA), which manages the subscription across all stores.
  • Data Points: your account identifier, email address and display name, the app version and an installation identifier, your purchase history (product, store, start and end dates, trial), and the receipt or transaction identifiers from the App Store, Google Play or Stripe. On our servers we keep only the subscription state: active or not, the store, the product and the expiry date.
  • Purpose: to sell, verify and manage your subscription on all your devices and on the web, and to help with payment questions.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)).
  • Retention: the subscription state is deleted with your account. RevenueCat keeps the transaction history as required for tax and accounting.
  • Safeguards for Transfer: Standard Contractual Clauses (SCCs).

9.2 Web Payments (Stripe)

On app.lista-cumparaturi.ro, payment is processed by Stripe through RevenueCat. Card details are entered directly into Stripe's form and never reach our servers.

  • Provider: Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA).
  • Data Points: payment details, email address, country and transaction data. On the payment page Stripe sets the cookies __stripe_mid (one year) and __stripe_sid (30 minutes), used to prevent fraud. These cookies are strictly necessary to take the payment.
  • Purpose: to take the payment, including VAT, to prevent fraud, and to let you manage the subscription in Stripe's customer portal.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)) and Legal Obligation for tax records (Art. 6(1)(c)).
  • Safeguards for Transfer: EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).

9.3 The Subscription's List Features

"Ce se termină" (what is running out), recurring lists, templates, the monthly recap and history with restore are computed on our servers from the list changes we already keep for syncing (which item was added, ticked or deleted, and when). They use no AI model and collect no new data about you. History can be read back 7 days on lists without a subscription and 12 months on subscribed lists. When an item is deleted we keep a copy of it in the history so that it can be restored. The Friday reminder ("Ce se termină") is a notification you can turn off in the list's notification settings.

9.4 Lists from a Photo or a Recipe

If you turn a photo (a handwritten list, a recipe) or a recipe (text or a link) into items, the photo or text is sent through our servers and our own AI access platform, both hosted on Hetzner Online GmbH infrastructure within the EU, to an AI model that extracts the items. For a link, our servers download the recipe page and send only its text.

  • Provider: Google Ireland Limited / Google LLC (Gemini models).
  • Data Points: the photo, text or recipe page. We do not send the provider your name, email address or account identifier.
  • Purpose: to add the items to your list without typing them. The suggested items are shown to you before they are added.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)).
  • Retention: the photo and text are not kept on the app's servers. Our AI access platform keeps the request and the reply for at most 60 days for troubleshooting, then deletes them; only the CodingShadows administrator can access them. The number of imports your account made each month is kept for the monthly limit and deleted with your account.
  • Safeguards for Transfer: EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).

10. Our Websites: codingshadows.com and codingshadows.ro

This section applies when you visit the Websites. The Websites have no user accounts. The general provisions of sections 1, 6 and 7 also apply.

10.1 Server Logs

The Websites are served by our own web servers, hosted on Hetzner Online GmbH infrastructure within the EU (see section 4). Each request is recorded in the access logs of our reverse proxy and web server.

  • Data Points: your IP address, date and time of the request, the domain and page requested, the request method and protocol, the response status, size and duration, the referring page, and your browser's user agent (browser and operating system). If your browser reports a breach of our Content Security Policy, the report (the page address, the blocked resource and your browser's user agent, without your IP address) is logged as well.
  • Purpose: to deliver the Websites, keep them secure, limit abusive traffic, and diagnose faults.
  • Legal Basis: Legitimate Interest (Art. 6(1)(f)) in operating secure and reliable Websites.
  • Retention: the logs are collected in our central log store, kept on Hetzner Online GmbH object storage in Germany, and deleted automatically after 90 days.

10.2 Cloudflare: Content Delivery, Security and Web Analytics

Both Websites are delivered through the network of Cloudflare, Inc. Every request to the Websites first reaches a Cloudflare server, which forwards it to our servers, so Cloudflare processes your IP address and the request data listed in section 10.1 in order to deliver, cache and protect the Websites. Cloudflare's browser check is active on both domains: a request that Cloudflare considers suspicious may be asked to pass a short check, and a browser that passes it receives the cf_clearance cookie, which records that the check was passed so it is not repeated. This cookie is strictly necessary for the security of the Websites. Cloudflare's Bot Fight Mode is switched off, so the __cf_bm bot-management cookie is not set. Cloudflare describes its cookies in its cookie documentation.

Cloudflare Web Analytics is enabled for both Websites. Cloudflare adds its measurement script (loaded from static.cloudflareinsights.com) to the pages it delivers, and the script reports to cloudflareinsights.com when a page is viewed: the page address without its query string, the referring page, page-load timings, the browser and operating system and the visitor's country. According to Cloudflare, Web Analytics does not use cookies, local storage or device fingerprinting and does not identify individual visitors. We use it to count page views and to measure how fast the pages load.

  • Legal Basis: Legitimate Interest (Art. 6(1)(f)) in delivering and protecting the Websites and in measuring their traffic with a tool that stores nothing on your device.
  • Retention: Cloudflare keeps the detailed Web Analytics data for 7 days and aggregated data for up to six months, as stated in its Web Analytics documentation.
  • Safeguards for Transfer: Cloudflare, Inc. is based in the United States. Transfers rely on Cloudflare's certification under the EU-U.S. Data Privacy Framework and, in addition, on the Standard Contractual Clauses incorporated in the Cloudflare Data Processing Addendum.

10.3 Contact Form and Emails

When you send a message through the contact form, your browser sends it directly to our own messaging service at messaging.codingshadows.com (this request does not pass through Cloudflare).

  • Data Points: the name, email address and message you enter, labelled as coming from the CodingShadows Website. The service also records the IP address the message came from, your browser's user agent, the date and time, and the processing status.
  • How it is handled: the message is stored in our database, hosted on Hetzner Online GmbH infrastructure within the EU, and our messaging service emails your name, email address and message to our mailbox, provided by Google (Google Workspace, see section 4), where we read it. If you gave an email address, it is set as the reply address, so our answer goes straight to you. We reply from contact@codingshadows.com. The IP address is used to limit each address to 6 messages per minute, in order to stop spam and abuse.
  • Purpose: to answer your enquiry and, where you ask for it, to prepare an offer.
  • Legal Basis: Contractual Necessity (Art. 6(1)(b)), as steps taken at your request before entering into a contract; Legitimate Interest (Art. 6(1)(f)) for answering other enquiries and for protecting the form against abuse.
  • Recipients: Hetzner Online GmbH (hosting, see section 4); Google Ireland Limited / Google LLC, whose mail servers (Gmail, part of Google Workspace) send the email and whose mailbox stores it. Google processes this data in its data centres in the EU and outside it, including the United States; the transfer safeguards are the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses described in section 4.
  • Retention: we keep contact-form messages for as long as the conversation with you may continue, and we review them once a year to delete those we no longer need. You can ask us to delete your message at any time by writing to contact@codingshadows.com. Database backups that contain these messages are deleted automatically after 90 days.

If you write to us by email instead, your message is received and stored in the same mailbox, provided by Google, under the same safeguards.

10.4 Third-Party Resources

The Websites load their fonts, scripts and images from our own servers, apart from the Cloudflare script described in section 10.2. They embed no third-party content: links to app stores, YouTube and other sites are ordinary links, and the other site receives your IP address only when you open the link.

10.5 Cookies, Consent and Microsoft Clarity

The Websites do not set cookies of their own and do not store data in your browser's local storage. The only cookie that can be set today is Cloudflare's security cookie described in section 10.2, which is strictly necessary and therefore does not require consent.

We may use Microsoft Clarity, a session recording and heat map service provided by Microsoft Corporation, to understand how visitors use the Websites and to improve them. Clarity is loaded only after you give your consent in a consent banner shown on the Websites, and never before. Until that banner is in place, Clarity is not used.

  • Data Points: how you interact with the pages (mouse movements, clicks, scrolling and the parts of the page you view), recorded as a session replay and aggregated into heat maps; the pages visited, the referring page, the device type, browser, operating system, screen size and approximate location derived from your IP address. We configure Clarity to mask the text you type into form fields, so it is not recorded.
  • Cookies: Clarity sets the first-party cookies _clck (a pseudonymous visitor identifier) and _clsk (links the pages of one visit into a single recording), and Microsoft may set its own cookies (CLID, MUID, ANONCHK, MR and SM), as listed in Microsoft's Clarity cookie documentation.
  • Legal Basis: your Consent (Art. 6(1)(a) and Article 4(5) of Romanian Law No. 506/2004). You can withdraw your consent at any time from the consent banner, with effect for the future.
  • Retention: Microsoft keeps session recordings for 30 days (a small sample and recordings we mark as favourites for up to 13 months) and heat map data for 13 months, as stated in Clarity's data retention documentation.
  • Safeguards for Transfer: Microsoft Corporation is based in the United States. Transfers rely on Microsoft's certification under the EU-U.S. Data Privacy Framework and on the Standard Contractual Clauses in Microsoft's data protection terms.

From 15 June 2026 to 7 October 2026 the Websites loaded Clarity on every page without asking for consent. We removed it on 7 October 2026 and deleted the Clarity project and the data it had recorded.

10.6 Your Rights for Website Data

You have the rights described in section 6, including the right to object to processing based on legitimate interest, and the right to complain to the authority named in section 7. To exercise them for data collected through the Websites, write to contact@codingshadows.com.