Privacy Policy

Effective date: June 27, 2026

This policy explains what personal data 403AI ("we", "us") collects, why, and the choices you have. It applies to 403ai.org (the "Site").

Who we are

403AI operates the Site as an independent collective. For privacy questions or to exercise your rights, contact us at 403ai.org@gmail.com. We keep our operational identity private by design; this is a deliberate choice and does not reduce the rights described below.

Children

The Site is intended only for people who are 18 or older, and it is not directed to children. We do not knowingly collect personal information from anyone under 18, and specifically not from children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA). We do not target children, profile them, or serve them advertising. If you believe a person under 18 (or under 13) has provided us personal information, contact us at 403ai.org@gmail.com and we will delete it promptly.

What we collect and why

We collect only what each feature needs:

• Newsletter: your email address, when you subscribe. Used to send the newsletter. Basis: your consent. You can unsubscribe at any time via the link in any email. Your email is stored in our database until you unsubscribe.
• Account (sign-in): if you create an account with GitHub or Google, we receive your name, email address, profile image, and a provider account identifier. Used to authenticate you and maintain your account. Basis: performance of the service you requested. The public handle you choose is the only identity shown to others by default.
• Profile (optional): any fields you choose to add: display name, bio, and links (shown publicly); and role, company, interests, legal name, phone number, and date of birth (kept private and visible only to us, never shown on your public profile). Used to power your public profile, to understand our audience, and for internal purposes as we build features for our community (including a future paid-membership program). Basis: your consent. All fields are optional. You can also set your public profile to private, which makes it unreachable to others.
• Work-with-us inquiries: when you contact us through "work with us", the details you submit, such as name or handle, email, company or links, and your message. This covers both business inquiries and developer collaboration requests. Used to respond and to discuss potential work. Basis: your consent and steps taken at your request before any agreement.
• Analytics: aggregate, cookieless usage data via PostHog. It is not linked to your identity and uses no tracking cookies. Basis: our legitimate interest in understanding and improving the Site.
• Security and operation: your IP address and basic request metadata are processed transiently for rate-limiting and abuse prevention, and standard server logs are generated. Basis: our legitimate interest in keeping the service secure.

A phone number is only ever collected if you choose to add one to your optional profile fields, or at a later, clearly labeled stage of a business engagement — never required, and never shown publicly. We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

Cookies

We use only essential cookies: an authentication session cookie when you are signed in, and a security (CSRF) token. We do not use advertising or cross-site tracking cookies, and our analytics is cookieless. We honor Do Not Track.

How we share data

We do not sell your personal data. We share it only with service providers ("processors") that operate the Site on our behalf:

• Vercel for hosting
• Neon for database storage
• Resend for newsletter and transactional email delivery
• Upstash for rate-limiting
• PostHog for cookieless analytics
• GitHub / Google for sign-in, if you choose to use them

We may also disclose data where required by law or valid legal process, or to protect our rights, users, or the public. Some providers are located in the United States. Where data is transferred outside your region, we rely on appropriate safeguards such as Standard Contractual Clauses.

How long we keep it

• Newsletter email: until you unsubscribe.
• Account and profile data: until you delete your account.
• Inquiry data: as long as needed to respond and for a reasonable follow-up period.
• Security logs: a short retention period for abuse prevention.

Newsletter archive issues are public content. Analytics data is aggregate.

You can delete your account and associated profile data yourself from your account settings.

Your rights (GDPR / UK GDPR)

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our use of your personal data, to data portability, and to withdraw consent at any time. You can also lodge a complaint with your local data-protection authority. To exercise any of these, use the account tools or contact us at 403ai.org@gmail.com. We will respond within the time required by applicable law.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect and why, to request access to or deletion or correction of it, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising. The categories we collect are described above. To exercise these rights, contact us at 403ai.org@gmail.com. We will not discriminate against you for exercising them.

Security

We use reasonable technical measures to protect personal data, including hashed passwords (argon2id) where applicable, parameterized database queries, and rate limiting. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Changes

We may update this policy. Material changes will be posted here with a new effective date.

Contact

Questions about this policy or your data: 403ai.org@gmail.com.