Privacy Policy — stedding.dev

Who is responsible

YS Progress Inc., a corporation incorporated in Ontario, Canada, operating from Markham and Toronto, Ontario. In this policy, “we”, “us” and “our” mean YS Progress Inc.

Questions, requests and complaints about privacy: any@ys.contact. Please put “Privacy — stedding.dev” in the subject line so the request is not missed.

For Quebec’s Law 25, the person responsible for the protection of personal information at YS Progress Inc. is the officer holding the highest authority in the company, reachable at the same address. Nothing described here identifies a browser or builds a profile of you, so there is nothing to switch on or off.

We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR, and we are not required to appoint a data protection officer under Article 37: the processing described here is occasional, involves no special categories of data and no large-scale monitoring, and is unlikely to result in a risk to your rights.

What this policy covers

This policy covers the website at stedding.dev, its subdomains, and any other address at which we serve the same files. It does not cover the Stedding browser itself, which is separate software that runs on your own computer and sends no telemetry; every network connection it makes is documented, connection by connection, in docs/PRIVACY.md in the source repository. It also does not cover other websites this one links to, such as GitHub, which have their own policies.

What we process, and why

Requests to the server

The site is served by Cloudflare Pages. Like any web server, Cloudflare’s network receives what your browser sends when it asks for a page: your IP address, the address requested, the date and time, the user-agent string, the referring page if there is one, and the response’s status and size. Cloudflare keeps this for a short period for delivery, troubleshooting and security — blocking attacks, for instance — under Cloudflare’s own privacy policy. We do not download or keep a copy of these logs. Where Cloudflare’s dashboard shows us recent security events for the site, we look at them only to investigate abuse; we do not use them to identify or profile visitors, and we do not combine them with anything else.

Where the GDPR or the UK GDPR applies to you, our legal basis is legitimate interests (Article 6(1)(f)): serving and protecting a website cannot be done without processing the request that asks for it, and the interest is balanced by the fact that the data is not used for anything else.

Cloudflare Web Analytics

Cloudflare counts page views for us with a small script injected by its network. It sets no cookie, reads and writes no storage on your device, and creates no identifier that can follow you to another site. It reports aggregate figures: pages visited, referrers, country, browser and operating system family, and page-load timings. We cannot single out a visitor in it, and neither this policy nor the product depends on your being identifiable in it. Like any request, the beacon’s own message to Cloudflare carries your IP address to Cloudflare, which uses it to derive the country and does not put it in the figures we see. Cloudflare describes the service in its own privacy policy.

Because it stores nothing on your device and produces no profile, we run it without asking. Where the GDPR applies, the legal basis is legitimate interests (Article 6(1)(f)): knowing how many people read a page, with no way to identify them, is a minimal intrusion, and it is the reason the cookieless option was chosen over the usual one.

Google Analytics, until 26 October 2026

From 16 September to 26 October 2026, a visitor who clicked “Allow Google Analytics” in this site’s banner had their page views sent to Google Analytics 4 (property G-B9SGVRNYGJ): the pages viewed and when, an approximate location derived from the IP address, the referring page, and technical details of the device and browser. Nobody who declined or did not answer was measured by it. Google Signals, advertising personalisation and advertising storage were off, and the data was never used for advertising.

We removed Google Analytics on 26 October 2026. Nothing has been sent to Google since. What Google collected before that, from visitors who allowed it, is held by Google LLC as our processor under Google’s terms and privacy policy, with user-level and event-level detail deleted 14 months after collection, under the retention we had set. The legal basis for it was the consent those visitors gave. To ask about it, or to have it deleted sooner, write to the address above.

Nothing else

The website has no accounts, no sign-in, no contact form, no comments, no newsletter, no payment, no chat widget, no session recording, no heatmaps, no A/B testing, no advertising network and no social-media buttons. We do not ask for your name, email address, postal address or payment details anywhere on this site, and there is nowhere on it to enter them.

Cookies and storage on your device

This site sets no cookies and stores nothing in your browser. Cloudflare Web Analytics sets nothing on your device either.

If you allowed Google Analytics here before 26 October 2026, its cookies _ga and _ga_B9SGVRNYGJ, and the stedding.analytics-consent entry that remembered your answer, may still be in your browser until they expire or you clear this site’s data. Nothing on the site reads them or sends them anywhere. Your browser still attaches the two cookies to its requests to stedding.dev, as it does with any cookie, and we do not read them there either. Clearing this site’s data in your browser removes all three.

Separately, if Cloudflare’s network challenges a request it judges to be automated, it may set a short-lived security cookie of its own, such as __cf_bm or cf_clearance. Those are security cookies, not measurement, and we do not read them.

Your choices

• No banner. Nothing on this site needs your permission, so it never asks.
• Global Privacy Control and Do Not Track. We sell and share nothing and nothing here follows you across sites, so there is nothing for either signal to switch off. Stedding Browser sends Global Privacy Control by default.
• Browser settings. Blocking JavaScript or using a content blocker stops Cloudflare’s page-view count; the site works without it.

Who else is involved

• Cloudflare, Inc. — hosting, content delivery, security and the cookieless page-view count.
• GitHub, Inc. (Microsoft) — the source code, the release files you download, and the issue tracker. Following a link to GitHub means GitHub receives that request under its own policies; we do not control that.

These are the only two. Google LLC still holds the Google Analytics data described above, collected before 26 October 2026, until it is deleted. Their handling of data is governed by their own terms, which we do not control, and we add no other third party without changing this page first.

Where data goes

We are in Canada. Cloudflare is a United States company with a network in many countries, and so is Google, which holds the data collected before 26 October 2026, so the processing described above takes place outside Canada, including in the United States, and is subject to the laws of those countries and to lawful access requests there. Where European or United Kingdom law applies, transfers rely on the mechanisms those providers publish, including standard contractual clauses.

How long it is kept

• Server and security logs: kept by Cloudflare under its own retention rules; we do not control that period and receive no copy.
• Cookieless page-view counts: kept by Cloudflare for the retention window of our plan, as aggregate figures with no identifier in them.
• Google Analytics event data collected before 26 October 2026: 14 months from collection, then deleted by Google.

Your rights

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and under the GDPR, the UK GDPR, the California Consumer Privacy Act and comparable laws where they apply to you, you may ask us to confirm what personal information about you we hold, to give you a copy of it, to correct it, to delete it, to restrict or object to its processing, or to receive it in a portable form. Where processing rested on consent, as Google Analytics did before 26 October 2026, you may withdraw that consent and ask us to have the data deleted. We do not sell or share personal information, and we collect no sensitive personal information as California law defines it, so there is nothing there for you to ask us to limit. We make no automated decision about you that produces a legal or similarly significant effect; Cloudflare’s network may automatically slow, challenge or block a request it judges to be an attack, which is a security measure rather than a decision about you as a person.

Write to any@ys.contact. We answer within 30 days, as PIPEDA requires, and will tell you if a request needs longer or if a law prevents us from acting on it. In practice the honest answer is usually short: this site keeps no file of visitors, so for most requests there is nothing about you for us to hold, and what exists sits with Cloudflare, or with Google for data collected before 26 October 2026, under the terms above. We may need enough information to be sure who is asking before we act on a request about specific data.

If you are not satisfied with our answer, you may complain to a supervisory authority: the Office of the Privacy Commissioner of Canada, the Information Commissioner’s Office in the United Kingdom, or the data protection authority of your country or state.

Children

This website is about desktop software for technical users. It is not directed to children, we do not knowingly collect personal information from anyone under 13 — or under the higher age at which consent is valid where you live — and there is nowhere on the site to submit any. If you believe a child has provided personal information through this site, write to any@ys.contact and we will delete what we can reach.

Security

The site is served only over HTTPS, with HTTP Strict Transport Security, and a Content-Security-Policy that names every host the page may contact; the whole .dev top-level domain is on the browsers’ HSTS preload list. The site stores no visitor data of its own, which removes the largest risk to it. No method of transmission or storage on the internet is completely secure, and we cannot guarantee absolute security of information in transit to or from this site or held by the providers named above.

Downloads and links

Builds of the browser are downloaded from GitHub Releases. Following a download link takes you to GitHub, which receives that request and applies its own privacy policy. The same is true of every other outbound link on this site. Check the published SHA-256 checksum of any build you download; the release notes explain how.

Changes to this policy

We may update this policy — for example if a provider changes, or if we add or remove a measurement. The date at the top of this page changes with it, and the previous wording stays in the history of the website’s repository. If we ever add a measurement that needs your consent, it will not run until you have agreed to it, rather than rely on this page having changed; other changes take effect when they are published here.

Governing law

This policy, and any dispute about it, is governed by the laws of the Province of Ontario and the federal laws of Canada applicable there, without regard to conflict-of-laws rules. That does not affect the data-protection rights you have where you live, or your right to complain to the supervisory authority there, and nothing in this policy limits a right you have under a law that cannot be limited by agreement.

Contact

YS Progress Inc. — Markham and Toronto, Ontario, Canada — any@ys.contact.

Security problems in the browser or on this website go through GitHub’s private vulnerability reporting on the source repository, not by email, so that a fix can be prepared before the problem is public.