Who we are

DigiCoyote is a software development firm based in Vancouver, British Columbia, Canada, operating this website at digicoyote.com. This policy covers the website only. Work we do inside a client engagement is governed by the agreement signed for that engagement.

Questions about this policy, or about data we hold, go to contact@digicoyote.com.

What we collect

Three things, and nothing else. We do not run advertising pixels, third-party analytics, session recording or cross-site trackers, and we do not buy or sell personal information.

• What you send us.When you submit the contact form we receive your name, email address and message, plus company, phone, budget, timeline and the services you selected, where you filled them in. We also record a one-way hash of your IP address and your browser’s user-agent string, used only to detect automated abuse of the form. The IP address itself is not stored.
• Page views.For each page view we record the path, the referring site’s domain (not the full URL), the date, and a salted hash that lets us count the same visitor twice in one day without knowing who they are. The salt rotates daily, so the hash cannot be used to follow anyone from one day to the next. No IP address and no cookie is involved, and requests from bots are excluded.
• Anything you paste into a tool. The developer tools store what you give them so they can work - a webhook bin keeps the requests it receives, a short link keeps its destination. See the tools section below.

Cookies

The public site sets no cookies at all. There is no cookie banner because there is nothing to consent to - analytics here works without them.

One cookie exists on the site: a session cookie set after signing in to the private admin area at /admin. It is strictly necessary for that sign-in to work, is not set for ordinary visitors, and is not used for tracking.

The developer tools

The tools are free, unauthenticated and deliberately short-lived. Whatever you put into them is stored only long enough for the tool to be useful and is then deleted automatically - rooms after 6 hours, webhook bins, status monitors and most other state after 24 hours, and short links and mock endpoints for the period you choose, up to 30 days. Expired data is removed by a sweep rather than left to linger.

Anyone who knows a tool’s URL can see its contents; the tokens are unguessable but they are the only protection. Treat the tools as a scratchpad, and do not put production secrets, personal data or anything confidential into them.

The one exception is the one-time secret tool, which encrypts in your browser. The decryption key lives in the fragment of the link - the part after the # - which browsers never transmit. We store ciphertext we cannot read, and it is destroyed on first view.

Some tools make a request on your behalf when you ask them to: the status monitor and HTTP client fetch the URL you enter, the DNS tool queries public registry data through rdap.org, and the password checker sends the first five characters of your password’s SHA-1 hash to the Have I Been Pwned range API. That last one is k-anonymity - the password itself never leaves your browser, and the service cannot tell which password was being checked.

Where your data is stored

Enquiries and page-view counts live in a PostgreSQL database on a server we run at DigitalOcean in San Francisco, in the United States. We are a Canadian company, but this means the data is held in the US and is subject to US law, including lawful access requests made there. Submitting the form is your consent to that transfer.

Enquiry notifications are delivered to us by email through a third-party mail relay, which handles the message in transit.

Fonts and scripts are served from our own domain. Loading a page on this site does not cause your browser to contact any third party.

How long we keep it

Enquiries are kept while there is an active or realistic prospect of working together, and as long afterwards as we need them for our business records. Ask and we will delete yours sooner.

Page-view records are aggregate counts with no identifier attached beyond the daily rotating hash. Tool data is deleted on expiry as described above.

Your rights

Under Canadian privacy law - PIPEDA, and British Columbia’s PIPA - you can ask what personal information we hold about you, ask us to correct it, ask for a copy, and ask us to delete it. If you are in the UK or the EU, the equivalent rights under the UK GDPR and GDPR apply, and our lawful basis is legitimate interest in responding to an enquiry you chose to send us.

Email contact@digicoyote.com and we will act within 30 days. We will not ask you to justify the request, and there is no charge.

If you are unhappy with how we have handled it, you can complain to the Office of the Privacy Commissioner of Canada.

Security

The site is served over HTTPS. Passwords for the admin area are hashed with bcrypt, the database is not reachable from the public internet, and the tools that fetch URLs validate the destination on every redirect to stop them being used to reach private networks.

No system is perfectly secure, and we will not claim otherwise. If you find a vulnerability here, please tell us at contact@digicoyote.com - we will respond, and we will not threaten you for reporting it.

Changes

If this policy changes we update the date at the top of the page. Material changes to how we handle information already collected will be announced here rather than made quietly.