Learn how DCYFR Labs collects, uses, and protects your information. We prioritize privacy with minimal data collection and no tracking.
Last Updated: October 15, 2026
At DCYFR Labs, we believe in transparency and privacy by design. This policy explains how we collect, use, and protect your information when you visit our website.
Controller: DCYFR Labs is a trading name, not a registered company. The sites are run by one individual working as a sole proprietor in Colorado, United States, and that person is the data controller for everything described here. We name the arrangement rather than imply a corporate entity that does not exist. For any question about this policy, or to exercise the rights described below, contact us.
This policy is the canonical privacy policy for the DCYFR web estate. It covers dcyfr.ai and the sibling sites dcyfr.io, dcyfr.app, dcyfr.bot, dcyfr.codes, dcyfr.tech, dcyfr.work, and dcyfr.build.
Each sibling site carries its own short notice at /privacy listing the processors that site actually uses, because they are not identical: dcyfr.bot sends chat messages to a model provider, dcyfr.codes publishes snippets to GitHub, and the rest do not. Where a site notice and this policy differ on a detail specific to that site, the site notice is the accurate one.
Purpose: To respond to your inquiries and provide support. Storage: Contact form data is processed via Inngest and not permanently stored. We only retain your email in our inbox for correspondence purposes.
We store preferences locally in your browser to enhance your experience:
Search History: Recent searches in command palette
Bookmarks: Saved blog posts and pages
Likes: Activity engagement (blog posts, projects)
Purpose: Personalize your experience with saved preferences. Storage: Client-side only (not shared with server unless you log in). Control: Clear via browser settings or our UI.
The site header lets you pick a colour cut for the site. Choosing one sets a single first-party cookie:
Name:dcyfr-cut
Contents: the name of the cut you chose, such as rainbow. Nothing else: no identifier, no timestamp, no record of what you did on the site
Lifetime: one year from the last time you chose
Who reads it: this site only, on each request, so the page renders in your cut before it paints. It is not sent to any other domain and no third party receives it
Purpose: Remember a display preference you set yourself. Control: Delete the cookie in your browser’s site data settings and the site returns to the default black cut. Choosing black keeps a cookie that says black, so your choice survives a later change of our default. Until you choose a cut, no cookie is set.
For certain interactive features, we create temporary encrypted sessions:
Session identifier (randomly generated)
Temporary preferences
Purpose: To maintain state for interactive features. Storage: Encrypted in Vercel Redis (managed Redis service) with automatic expiration (24-48 hours). Security: All session data is encrypted using industry-standard encryption (AES-256-GCM). Provider: Vercel (powered by Upstash infrastructure, GDPR-compliant)
Purpose: Security monitoring, error detection, and performance optimization. Retention: Automatically deleted after 30 days (Vercel’s standard retention).
Tracking Cookies: The one cookie we set (dcyfr-cut, described above) stores the colour cut you chose and nothing else; no cookie of ours identifies you. Third-party content you choose to load (the giscus comment box, an embedded YouTube or Vimeo player) is served by those providers and may set their own cookies once loaded
Individual User Tracking: No cross-site tracking, user profiles, or behavioral analysis. Sentry Session Replay records a small sample of individual sessions for debugging; see Session Replay below
Invasive Analytics: No Google Analytics, Facebook Pixel, or similar tracking platforms that follow users across the web
Advertising Data: No ad networks or retargeting pixels
Social Media Tracking: No social media plugins that track you
Fingerprinting: We don’t create browser fingerprints or device identifiers
Sensitive Personal Information: No SSN, payment info, health records, or similar sensitive data
Our error monitoring includes Sentry Session Replay, which reconstructs what happened in the browser leading up to a problem.
When it runs: roughly 5% of sessions on dcyfr.ai, plus 50% of sessions in which an error occurs. Sibling sites sample about 1%.
What it captures: DOM mutations, clicks, scrolls, navigation, and network timing, which is enough to replay the sequence of events.
Masking: text content and media are masked at capture, in the browser, before anything is transmitted. A replay shows layout and interaction, not the words on your screen. Form inputs are masked on the same basis.
What it is used for: reproducing faults. It is not used for analytics, profiling, marketing, or measuring individuals.
Retention: replays are stored by Sentry and expire on Sentry’s retention schedule.
Opting out: block sentry.io in your browser, or use an extension that blocks error-monitoring scripts. Every site in the estate works without it.
We use Vercel Analytics and Speed Insights to understand how our website performs. Unlike traditional analytics platforms, these are privacy-first services:
Retention: Analytics data is retained for 30 days (Vercel’s standard retention). Opt-out: If your browser sends a “Do Not Track” or Global Privacy Control signal, this site drops Vercel Analytics and Speed Insights events before they are sent. Learn More:Vercel Analytics Privacy Policy
Purpose: Comment threads on articles, backed by GitHub Discussions
Data Processed: Loaded in an iframe from giscus.app. If you sign in to comment, you authenticate with GitHub and your comment is public in the linked discussion
Cookies: giscus and GitHub may set cookies once the comment box loads
Some US states give their residents specific rights over personal information. DCYFR Labs may not meet the thresholds that make these laws apply to it, but we honour the rights below for anyone who asks, wherever they live.
Know what personal information we collect, use and disclose, and get a copy of it.
Delete personal information we hold about you.
Correct personal information that is inaccurate.
Opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of. If your browser sends a Global Privacy Control signal, we treat it as an opt-out request anyway.
Limit use of sensitive personal information. We do not collect it.
Not be treated differently for using any of these rights.
In the last 12 months we collected identifiers (your name and email address if you use the contact form, and the IP address our host and error monitoring record), internet activity (pages viewed, referring site, performance timings, error reports and masked session recordings) and approximate location (country). We collect it from you and from your browser, for the purposes in “How We Use Your Information”, and keep it for the periods in “Data Retention”. If you comment through giscus, GitHub holds your account and comment, and if you use the dcyfr.bot preview chat, the text you send goes to Anthropic.
You can use an authorised agent. We will ask the agent for proof that you authorised them, and we may ask you to confirm your identity with us directly.
Confirm whether we process your personal data, and get access to it.
Correct inaccuracies in it.
Delete it.
Get a portable copy of it, up to twice a year.
Opt out of targeted advertising, the sale of personal data, and profiling that leads to legal or similarly significant decisions. We do none of these. If your browser sends a Global Privacy Control signal, we treat it as an opt-out, and you can authorise someone else to opt out for you.
Use the contact page and say which right you are using. We will confirm we received it within 10 business days, and we aim to answer within 30 days. The law allows 45. If we need more time, we will tell you why within the first 45 days and take no more than 45 more.
Appeals. If we decline your request, reply to our decision to appeal it. We will answer in writing within 60 days, or within 45 days if you live in Colorado. If we deny the appeal, we will tell you how to contact your state Attorney General: the Consumer Protection Division in Maryland, or the Colorado Attorney General.
DCYFR Labs operates from Colorado in the United States. If you access our website from outside the United States, please be aware that:
Your information may be transferred to and stored in the United States
U.S. data protection laws may differ from those in your country
By using our website, you consent to this transfer and processing
For users in the European Economic Area and the United Kingdom, the rights listed above apply in
full, and the legal bases we rely on are set out at the end of this policy. Collecting little data
reduces how much is at stake, but it is not by itself compliance, so we describe what we actually do
rather than claim a verdict on it.
Article 27 of the GDPR requires a controller established outside the Union to designate a
representative inside it when the controller offers services to, or monitors the behaviour of, people
in the EU. The UK GDPR sets a parallel requirement for the United Kingdom.
No representative is currently designated for either. That is a gap, and we would rather state it
than leave the question unanswered. Until one is appointed, people in the EU and the UK can reach the
controller directly through our contact page, and every right described above is available
to them on the same terms as to anyone else. You may also lodge a complaint with the supervisory
authority in your country of residence, which you can do whether or not a representative exists.
Our website is not directed to children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete it.
If you have questions, concerns, or requests regarding this privacy policy or our data practices, please contact us. We aim to reply within five working days. Where a request is one of the rights listed above, the GDPR allows a controller one month to answer it, and we will not take longer than that.