Privacy Policy

Information we collect

This website has no accounts and no login. We don't ask you to create a profile, and we don't collect personal information as you browse.

If you fill in the form on our Join page, we receive what you type: the option you picked (pitching a product or joining a team), your name, your email address, the discipline you'd bring, optionally your university and a link you choose to share, and your message. Everything on that form is something you decided to tell us.

The same applies if you email us instead — we receive whatever your message contains.

Alongside a form submission we also record a few technical details, purely to stop spam and abuse: your browser's user-agent string, the two-letter country our host reports, and a one-way cryptographic hash of your IP address. We do not store your IP address itself, and the hash cannot be turned back into one.

If — and only if — you allow analytics (see the Cookies and Analytics sections below), we also collect a small amount of anonymous usage data as you browse: which pages and products you view, which external links you follow, the page you arrived from, any campaign tag in the address, your language and light/dark preference, a coarse device, browser, and operating-system category, the two-letter country our host reports, and how far down a page you read. None of this names you, and we never collect it until you opt in.

Like any website, our hosting provider keeps standard server logs (including IP address, browser type, and pages requested) for a limited time to keep the site running and secure.

How we use information

We use what you send through the form or by email only to reply to you and to consider your pitch or application. Every submission is read by a person at the studio.

We use the technical details described above only to detect and limit spam and automated abuse of the form. They are not used to profile you, and they're never combined with anything else to identify you.

If you've allowed analytics, we use that usage data only in the aggregate — to understand which products draw interest, which links people follow, where our visitors come from, and how the site is actually used — so we can make it better. It is not used to build a profile of you, to advertise, or to track you across other sites.

We do not sell your personal information, we don't use it for third-party advertising, and we don't run advertising or cross-site tracking on this site.

Sharing and service providers

We rely on a small number of service providers to run the site. Vercel hosts it and serves the pages. Supabase hosts the database that stores form submissions and, if you allow analytics, the anonymous usage events. Both process this data on our behalf, only as needed to provide their service, and under their own security and privacy commitments.

Our analytics are first-party: the usage data stays in our own database and is not sent to Google Analytics, an advertising network, or any other outside tracker. Nobody else receives your submission either — we don't share it with recruiters, partners, or any other third party.

We may disclose information if required by law, or to protect the rights, safety, and security of our users and the studio.

Cookies

We use a small, clearly-separated set of cookies, split into two groups.

Essential cookies are always on because the site can't work correctly without them, and under the ePrivacy rules they don't require consent. There are two: NEXT_LOCALE, which remembers the language you're viewing the site in; and uc_consent, which remembers your cookie choice so we don't ask again on every visit. Neither contains an identifier, and neither is used to track you.

Non-essential cookies are off until you turn them on. There is currently one: uc_vid, an anonymous, randomly-generated visitor identifier used only by our own analytics to tell new visitors from returning ones. It is not linked to your name, your email, or your IP address, and it is set only after you accept analytics. We also keep a short-lived, per-tab session identifier in your browser's session storage while analytics is on; it clears when you close the tab.

The first time you visit, we ask. You can Accept or Decline with equal ease, or open Manage to make the choice yourself — and you can change your mind at any time from the “Cookie settings” link in the footer. Declining, or later switching analytics off, removes the uc_vid cookie and stops all analytics collection immediately. If your browser sends a Global Privacy Control (or Do Not Track) signal, we treat that as a decline and don't show the banner.

We use no third-party advertising cookies, no cross-site tracking, and no fingerprinting.

Analytics and your choice

When you allow analytics, we measure how the site is used with our own first-party analytics — no Google Analytics, no advertising pixels, nothing that follows you to other sites. It runs only after you opt in.

What we record is deliberately limited to what helps us improve the site: the pages and products you view, the external links (such as App Store or Google Play) you follow and from which product, the buttons that lead into our Join form and whether a submission was completed, the page or campaign that brought you here, your language and light/dark preference, a coarse device, browser, and operating-system category, the country our host reports, and roughly how far down a page you read.

What we deliberately do not do: we don't store your IP address for analytics, we don't keep your full browser user-agent (only a broad category), we don't record what you type into the form, and we don't try to identify you or build an advertising profile. The visitor identifier is a random token with no meaning outside our own aggregate counts.

You're always in control: turn analytics off from “Cookie settings” in the footer whenever you like, and we'll stop and remove the identifier.

How long we keep it

We keep form submissions for as long as we may reasonably need them to follow up with you and to keep a record of who we've spoken to. If you'd like yours removed sooner, email us and we'll delete it.

The anti-spam details attached to a submission — the hashed IP and user-agent — serve no purpose once the submission has been reviewed, and are removed or scrubbed on a rolling basis.

Anonymous analytics events are kept for up to roughly fourteen months and then deleted, and they hold nothing that identifies you in the first place.

How it's protected

Submissions are stored in a database that is not reachable from the public internet: it can only be written to by our own server, and the credentials that allow this are never sent to your browser. The site is served over HTTPS only.

The form is rate-limited and protected against automated abuse. No security is perfect, but we've kept the amount of data we hold deliberately small so that there is little to lose.

Your choices and rights

Because we hold little more than the messages you send us, the simplest way to access, correct, or delete your information is to email us and ask — we'll act on it. Depending on where you live, you may have additional rights under local law (such as access, correction, deletion, restriction, portability, or objection), and we'll honour valid requests.

Where we rely on a legal basis under the GDPR, it is our legitimate interest in responding to people who contact us and in protecting the site from abuse; for analytics, the legal basis is your consent, which you can withdraw at any time from the “Cookie settings” link in the footer with no effect on what came before.

Students and younger users

The studio works with students, and this site is aimed at a general, adult audience — it isn't directed at children under 13, and we don't knowingly collect their information here. Our individual products state their own age and eligibility rules in-app.

Changes and contact

We may update this policy as the site and our products evolve; when we do, we'll change the date at the top of this page.

Questions about privacy? Email us at info@unichat.dev.