1. The short version
Some storage is needed to run the site — to keep you signed in, to stop abuse, and to remember the choices you make. That is on, and the site cannot work without it.
One thing is on unless you switch it off: while you read without an account, this browser remembers your progress, so a course can show what you finished and an account you create can keep it. It never leaves your device until you sign in. Everything else is off until you turn it on. We do not use advertising or cross-site tracking of any kind. Refusing costs you nothing: every lesson, every tool and every feature works exactly the same.
— change your choices at any time. The same link is in the footer of every page.
2. Strictly necessary
These are exempt from consent because without them the site cannot do what you asked it to. That is a narrow test and we apply it narrowly — note the theme row: a theme you switch to yourself is remembered because remembering it is the thing you asked for, while a theme we merely guess from your operating system is applied and never written down.
One row deserves a word of explanation, because it looks like the opposite of what it is. dfl_exclude_traffic is written only on our own devices, and only to keep our own reading out of the visitor figures. It is listed here anyway: the test for disclosure is whether something was written to your device, not whether it was harmless.
3. Your progress on this device
If you read lessons without an account, we remember on this device which sections you read, which lessons you finished and which exercises you passed. It is not strictly necessary — the lessons work without it — so it is yours to switch off: under the title of any lesson, turn off Remember my progress on this device. That deletes what was kept and keeps nothing more.
Nothing here is sent to us while you are a guest. When you sign in on this browser, it is added to your account (we check each lesson and section against the lesson itself, and keep the dates you finished them) and removed from here.
4. Counting visits, with no cookie at all
We count how many people read the site, which country they are in, and which pages they open. None of it involves your device: it is worked out from what your browser sends with any request, so there is no storage to consent to and nothing is written or read here.
We never keep your IP address. It is turned into a one-way hash under a secret that changes daily, purely so one reader is counted once a day instead of once a page, and that hash is deleted within 48 hours. What survives is a row like “12 August, Ukraine, 431”. The Privacy Policy sets out the lawful basis and how to object — including the Global Privacy Control signal, which we honour before anything is recorded.
5. Optional — only after you allow them
None of the following exists in your browser until you say so, and all of it is removed or stops when you withdraw.
6. Embedded videos
Lessons sometimes embed a video hosted by YouTube or Vimeo. Until you allow embedded content, the player is not placed on the page at all — you see a placeholder instead, and the provider is never contacted, so it never learns your IP address or which lesson you are reading.
Clicking Load video on that placeholder is your consent for embedded content across the site. Every placeholder also offers a direct link, so you can watch without turning anything on.
7. Browser signals we honour
Global Privacy Control. If your browser sends a GPC signal, we treat it as a refusal of everything optional, we do not show you the banner, and we record the refusal. You can still opt in afterwards from Cookie settings.
Do Not Track. We do not act on it. The specification was withdrawn, browsers send it inconsistently, and treating an ambiguous signal as a decision would be its own kind of dishonesty. We would rather tell you that than imply a protection you do not have. Use GPC instead — it is supported by Firefox, Brave and DuckDuckGo, among others.
8. How long your choice lasts
Twelve months, then we ask again. A refusal lasts exactly as long as an acceptance — asking someone who has already said no more often than someone who said yes would be a way of wearing them down, not a way of asking.
We also ask again if this policy changes in a way your previous answer could not have covered — a new provider, a new purpose, a new category. Wording and typo fixes do not re-ask.
9. What we keep as proof
Data protection law requires us to be able to demonstrate that consent was given, so each decision is recorded on our servers: which categories you chose, which version of this notice you were shown, when, and a random identifier from the cookie above that links your decisions together without identifying you.
We do not store your IP address with it. We store a one-way cryptographic hash of it, which shows two decisions came from the same device without recording which device that was. Records are deleted after three years.
10. Contact
Questions about this policy, or a request to see or delete what we hold: privacy@devfoxlabs.com