Privacy policy
Who we are
This site and the services described on it are operated by Devcity, registered in the Republic of Maldives under number SP14842022. We are the people who decide what happens to the information described below.
Our address is Lot10128, HulhuMalé, Maldives.
If you want anything on this page explained, or you want us to act on one of the rights further down, write to info@devcitymv.com and a person will answer.
What we collect, and when
We collect different things depending on what you are doing. Nothing here is gathered for its own sake.
When you simply visit this website
Every visit is recorded so we can see which pages are worth keeping. That record holds your IP address, an identifier calculated from your browser, the country and city your connection appears to come from, your device type, browser, and operating system, and the pages you looked at. We do not need your name for this and we do not ask for it.
We do not load Google Analytics, advertising pixels, or any other outside tracking script on this site. The visit record described above is written by our own server and stays on it.
When you create an account
Your name, email address and password, plus a phone number if you give us one. Your password is never stored. What we keep is a one way hash of it, which lets us check a password you type without ever being able to read the original. If you switch on two factor sign in we also hold the secret your authenticator app needs, and your unused recovery codes.
When you contact us or subscribe
Whatever you write in the contact form, along with your name and email address, so we can reply. If you subscribe to the newsletter we keep your email address until you unsubscribe, and every newsletter carries an unsubscribe link.
When you buy something
What you ordered, what it cost, the invoice we raised, and the reference of the bank transfer you paid it with. Payments reach us by bank transfer and are approved by a person, so we see the transfer reference and whatever your bank puts on it. Billing details that belong on an invoice, such as a company name and address, are kept with the invoice.
When you register a domain through us
A domain registration is a public act. The registrant details you give us, which normally means a name, an address, an email address and a phone number, are sent to the registry and to our registrar and may appear in the public WHOIS record for that name. Privacy protection, where the extension allows it, replaces those details in the public record with the registrar's. It does not hide them from the registry or from us.
When we host your website
Everything you upload, and everything your own visitors send to it, sits on our server. That includes your files, your databases, and the web server logs, which record your visitors' IP addresses and the pages they asked for. We do not read your site's contents except when you ask us to help with something, or where we have to in order to keep the server running or to answer a lawful order.
When you use Devcity Mail
Your mail lives on our server, so we necessarily hold it: the messages themselves, who they came from and went to, your mailbox names and aliases, your rules and away messages, and how much space you are using. We also hold the delivery logs, the records of when a mailbox signed in, and the score our spam filter gave each incoming message.
Incoming mail is scanned automatically so that spam can be scored and filed. That scanning is done by software on our own server. Nothing is sent anywhere else to be read, and no person reads your mail as part of it.
Mailboxes on a paid plan are backed up every night so they can be restored if something goes wrong. A backup is a copy of your mail, and it is held for as long as your plan says.
When you install a product we licensed to you
Licensed software checks in with our licence server. That check sends the licence key, the domain and server it is installed on, an identifier calculated from that server, its IP address, and the version of our product and of PHP it is running. We use it to enforce the number of installations you bought and to spot a key being shared. The licence key itself is stored only as a hash.
When you ask for remote support
If you enrol a device for remote support and start a session, our technician sees your screen live and can control the mouse and keyboard while that session is open. Sessions happen only when you start them. We record that a session took place, who ran it and for how long. We do not record the screen itself.
Why we are allowed to hold it
- Because you asked us to do something. We cannot host a site, register a domain or run a mailbox without holding the information those things need.
- Because the law requires it. Invoices, payments and tax records have to be kept whatever anyone would prefer.
- Because we have a fair reason of our own. Keeping the servers up, stopping abuse, catching a shared licence key, and knowing which pages on this site are read.
- Because you agreed. The newsletter, and nothing else, runs on your agreement alone, and you can withdraw it at any time.
Who else sees it
We do not sell your information and we never will. It is shared only where the service cannot work otherwise:
- Our domain registrar and the domain registries. They receive registrant details because a registration cannot happen without them.
- Our servers. Your site, your mail and your backups sit on machines we rent, in the facilities of the companies that supply them.
- Banks. A transfer carries whatever your bank and ours put on it.
- Anyone a court tells us to tell. Where we are legally obliged to hand something over, we will, and we will tell you unless we are forbidden from doing so.
Nobody else. No advertising network, no data broker, no mailing list.
How long we keep it
- Your account for as long as it exists, and then for as long as we still need the invoices attached to it.
- Invoices, payments and tax records for as long as Maldivian law requires, which is longer than any request to delete them can override.
- Mail backups for the retention your plan sells, which is 14 nights on Standard and 30 nights on Plus. Free mailboxes bundled with hosting are not backed up at all, and that is stated when you buy hosting.
- Your mail and your website files for as long as your service is live. If you close a service we do not delete what is left on the server automatically. A person does it, after checking, so that nothing is destroyed by a timer.
- Visit records and server logs for as long as they are useful for spotting problems and abuse, and then no longer.
How it is kept safe
- The whole site runs over an encrypted connection, and so do the mail server's sign in ports.
- Passwords are stored as one way hashes, never as text we could read.
- Stored credentials that our own staff need, such as a server password, are encrypted at rest and reachable only by the most senior account.
- Licence responses are signed cryptographically, so a tampered reply is refused by the product rather than trusted.
- Access to the admin panel is restricted by role, and every sign in on a customer's behalf is written to an audit log with the name of the person who did it.
No system is perfect, and anybody who tells you theirs is should not be believed. If something does go wrong in a way that puts your information at risk, we will tell you.
What you can ask us to do
You can ask us, at any time, to:
- tell you what we hold about you,
- give you a copy of it,
- correct anything that is wrong,
- delete it, where we are not legally required to keep it,
- stop sending you the newsletter, which the link at the foot of any issue does immediately.
Write to info@devcitymv.com and we will answer within 30 days. We will ask you to prove who you are first, because handing someone's information to whoever asks for it is its own kind of breach.
Children
This website and our business services are meant for adults, and we do not knowingly collect anything about a child through them.
Our apps for children are a separate matter, and a stricter one. Zibbly is built for children aged four and up and it gathers nothing whatsoever. It asks for no permissions, has no way to reach a network, has no accounts, no advertising and nothing to buy. Nothing a child does in it ever leaves the phone, so there is nothing for us to receive, store or share. Its own policy is at https://devcitymv.com/products/zibbly/privacy.
Policies for individual products
Some of our products collect something this page does not cover, and some collect nothing at all. Each one says so on its own page:
Changes to this policy
When we change how we handle your information we will change this page and move the date at the top of it. If a change matters to you rather than merely to our lawyers, we will tell you directly.