Privacy Policy
Last updated: 19 September 2026
This policy explains what personal data notavibe handles when you visit notavibe.dev, why we handle it, who else touches it, how long it is kept, and the rights you have over it. notavibe has not launched: this site is a description of what we are building, plus a form to be told when it is ready. When the product itself starts processing personal data, this policy will be updated before that happens, not after.
1.Who we are
notavibe connects the companies that depend on open source with the maintainers who keep it alive, matched to real usage. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, notavibe is the data controller for the personal data described in this policy.
You can reach us about anything in this document at hello@notavibe.dev. We have not appointed a Data Protection Officer, as we are not required to; that address reaches the people who can action your request directly.
2.What we collect, and why
Four things, and only while you are on this site. Each is listed with the lawful basis we rely on for it.
2.1 Waitlist sign-ups
If you give us your email address to be told when notavibe launches, we store that address and nothing else alongside it. We use it for that one announcement. We do not use it for unrelated marketing, we do not pass it to anyone else, and you can withdraw your consent and be removed at any time, permanently.
Lawful basis: consent (Article 6(1)(a)).
2.2 Server and CDN request logs
Serving a page necessarily involves receiving a request for it. Our content delivery network records the metadata it needs in order to serve and protect the site — your IP address, the time of the request, the URL requested, your user agent and the referring page. We see this only as aggregate traffic figures.
Lawful basis: legitimate interests (Article 6(1)(f)) — secure, reliable delivery of the site.
2.3 Website analytics
We use Cloudflare Web Analytics to see how many people visit and which pages they read. It is cookieless: it stores nothing on your device, it does not fingerprint you, it does not follow you between websites, and it does not build a profile of you. It reports page views, referring sites, and coarse technical details such as browser, operating system and country, together with page performance measurements.
It works through a small script that Cloudflare adds to our pages at its edge, served from
static.cloudflareinsights.com. There is no advertising network involved and no
data broker; the measurements are visible only to us.
Lawful basis: legitimate interests (Article 6(1)(f)) — understanding whether the site is read and whether it performs.
2.4 Product analytics — only if you accept
We also use PostHog to understand how the site is actually used: which pages lead to which, where people stop reading, and whether someone who arrives from a link comes back later. Unlike the measurement in 2.3, this one can involve storing something on your device, so we ask first. Nothing is stored and nothing is sent until you have chosen.
If you accept, we set one first-party cookie on
notavibe.dev holding a random identifier. It lets us recognise the same
browser across visits, so we can tell a returning reader from a new one. It is scoped to
this site only — it is not sent to any other notavibe subdomain, it is not readable
by any other website, and it carries nothing about who you are.
If you decline, nothing is stored on your device at all — no cookie, no local storage. We still count the visit, but PostHog does that on its own servers using a privacy-preserving identifier it derives and rotates, rather than anything kept on your machine. You are given no persistent identity to carry between visits or between devices, and we hold nothing that links the visit back to you.
Either way, the site behaves identically, nothing is shared with any advertising network or data broker, we do not record your screen or your keystrokes, and the measurements are visible only to us. You can change your choice at any time — see section 4.
Lawful basis: consent (Article 6(1)(a)) for the cookie and the measurement that follows from it. You may withdraw it at any moment, and withdrawing is exactly as easy as giving it. Where you decline, the storage-free counting described above rests on legitimate interests (Article 6(1)(f)) — knowing how many people read the site — and involves no access to, or storage on, your device.
2.5 Web fonts
The typefaces on these pages are served by Google Fonts rather than by us, which means your browser requests those font files from Google directly and Google receives your IP address and user agent as a consequence. We set no cookie for it and we send Google no information about you beyond what any request for a file necessarily reveals.
Lawful basis: legitimate interests (Article 6(1)(f)) — presenting a consistent, legible site.
3.What we do not collect
We do not collect special-category data as defined in Article 9 of the GDPR — nothing about health, ethnicity, religion, political opinions, sexual orientation, trade union membership, genetics or biometrics. We do not carry out profiling or automated decision-making. We do not sell personal data, and we have never sold personal data.
There are no accounts on this site, so there is nothing to sign in to and no profile attached to you. notavibe is a tool for professional software developers and the organisations that employ them; it is not directed at children, and we do not knowingly collect personal data from anyone under 16.
4.Cookies and local storage
We set one cookie of our own, and only if you accept it — the product
analytics cookie described in section 2.4. It holds a random identifier, it is scoped to
notavibe.dev alone, and it exists for one purpose: telling a returning
reader from a new one. We set none for advertising and none for cross-site
tracking, and we never will on this site.
That cookie is why this site now carries a consent banner. It appears before anything is stored, it offers Decline as plainly as Accept, and until you answer, nothing is written to your device and nothing is measured. Declining is a complete answer: the site works the same and we lose the ability to recognise you, which is what you asked for.
Changing your mind. Withdrawing consent is as easy as giving it and takes effect immediately. Use the Cookie choices link in the footer of any page, or open notavibe.dev/#consent directly, and the banner returns with the choice reset. Clearing your browser's cookies for this site has the same effect.
If you use the light/dark theme switch, your choice is saved in your own browser's local
storage under the key nv-theme. That is not a cookie, it is never transmitted
to us, it is unrelated to the consent choice above, and clearing your browser storage
removes it.
Our content delivery network may set a strictly necessary cookie of its own for bot detection and security. We do not control its contents and we do not read it.
5.Who we share it with
We do not sell or rent personal data, and we do not share it for anyone else's marketing. We do use a small number of service providers to run this site, each of them acting as a processor under an agreement with us:
| Provider | What it does for us |
|---|---|
| Cloudflare | DNS, content delivery, security, and the cookieless website analytics described in section 2.3. This site is served through Cloudflare's edge network, which transiently processes connection data — including your IP address — to deliver and protect it. |
| PostHog | The product analytics described in section 2.4 — how pages are used and whether readers return. Your data is stored in the European Union (Frankfurt, Germany); PostHog is a US company, so its own staff may access it in support of the service, which is covered by our agreement with them and the safeguards in section 6. Only receives anything once you have accepted; if you decline, it counts the visit without storing anything on your device. |
| GitHub | Hosts this site's files and serves them. |
| Workspace, for the inbox that receives anything you send us. Google Fonts separately serves the typefaces on these pages. |
We may also disclose personal data where we are legally required to — for example in response to a valid legal request — or to establish, exercise or defend legal claims.
6.International transfers
Some of the providers above process data outside the European Economic Area, principally in the United States. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework, together with the additional safeguards those mechanisms require.
Where we had the choice, we took the European one. The analytics in section 2.4 is stored in the EU rather than the United States, and the provider that sends our email stores its data in Ireland, both for this reason. Neither provider is a European company, so their own staff may still reach the data in support of the service — that access runs under the same safeguards named above. We would rather tell you that than claim a clean European boundary that does not exist.
7.How long we keep it
| Data | Retention period |
|---|---|
| Waitlist email | Until notavibe launches and we have told you, or until you opt out — whichever comes first. Then deleted. |
| Request logs | Retained by our content delivery network under its own retention schedule. We keep no separate copy and build no history of your visits. |
| Website analytics (Cloudflare) | Retained by Cloudflare under its own retention schedule, as aggregate counts rather than records about individuals. We keep no separate copy. |
| Product analytics (PostHog) | Retained by PostHog under its own retention schedule. If you declined, nothing was stored on your device, and the identifier used to count you exists only on PostHog's servers under that same schedule. We keep no separate copy. |
| Analytics cookie | Stays in your browser until it expires or you clear it — or until you withdraw consent using the Cookie choices link, which removes it immediately. |
| Theme preference | Stays in your browser until you clear its storage. We never receive it. |
8.Your rights
If the GDPR applies to you, you have the right to:
- Access the personal data we hold about you, and receive a copy of it.
- Rectify it, if it is inaccurate or incomplete.
- Erase it, in the circumstances set out in Article 17.
- Restrict how we process it, in the circumstances set out in Article 18.
- Port it — receive it in a structured, commonly used, machine-readable format.
- Object to processing we carry out on the basis of legitimate interests.
- Withdraw consent at any time, where consent is the basis we rely on.
To exercise any of these, email hello@notavibe.dev. We will respond within one month, as the GDPR requires. There is no form to complete and no account to create, and exercising a right will never cost you anything.
You also have the right to lodge a complaint with a supervisory authority — normally the data protection authority of the country where you live or work — at any time, and without contacting us first.
9.Changes to this policy
We will update this policy as notavibe develops, and we will do so before any new
processing begins rather than after. The "last updated" date at the top always reflects the
version you are reading. Because this site is maintained in a public repository, the
complete history of every change to this page is public in NotAVibe-dev/web.
10.How to contact us
notavibe — data controller
Email: hello@notavibe.dev
For any request under section 8, that address is the fastest route.