Privacy policy

This privacy policy explains what information Freelance Codex collects, why it is collected, how it is used, and what choices you have.

We aim to keep this plain-language and practical. If you have questions, or you want to request access/deletion of information you submitted, contact us:

• Contact

This policy complements:

• Cookie policy (how cookies and analytics preferences work)
• Terms (use of the site and disclaimers)

Summary (the short version)

• We collect information you submit through forms (for example, Ask the Codex) or by emailing us, plus basic site usage data if you opt into analytics.
• If you create an account, we store your email address, your profile details, and anything you post (comments and likes).
• Comments are public. Your profile is public unless you switch it to members only. Your comments always show your name or handle, tagline, and profile photo.
• We use collected information to run your account, send sign-in emails, respond to messages, operate the site, improve content, and keep the site secure.
• A small set of service providers process data for us: Hetzner (hosting), Cloudflare (bot checks and profile photo storage), Mailjet (email delivery), and Google Analytics (only if you opt in).
• We do not sell personal data or build advertising profiles.
• You can control optional analytics via cookie preferences. See: Cookie policy
• You can request access, correction, or deletion of information you submitted by contacting us: Contact

What counts as “personal data” here

“Personal data” (or “personal information”) generally means information that identifies you, directly or indirectly. We treat user-submitted information and identifiable technical data carefully.

On Freelance Codex, personal data can include:

• direct identifiers you provide, like an email address (if you include one)
• account and profile details, like your handle, display name, tagline, and profile photo
• the content of messages you submit and comments you post, if it includes identifying details
• technical identifiers in server logs, like an IP address or user agent string
• analytics identifiers and usage data, if you opt into analytics (where applicable)

Some information becomes identifying when combined with other information. That’s one reason we keep optional analytics under consent controls (where required).

What we collect

We collect information in a few categories. The specifics depend on how you use the site.

1) Information you submit (forms and messages)

If you submit a form (for example, via Ask the Codex) or send us a message, we may collect:

• your email address (if provided)
• the content of your message or question
• any contextual fields you submit (for example, country, freelancing stage, or other details you choose to include)

When you send the Ask the Codex form, we don't save it in the site's database. It is emailed to our team inbox through Mailjet, and Mailjet also sends you a confirmation email with a copy of what you submitted. Before it is sent, the form runs a Cloudflare Turnstile check to filter out bots (see Data sharing).

Important: you control what you submit. If you want to keep something private, don’t include it. Avoid sharing sensitive personal information that is not needed to answer your question.

2) Account information

You can create a free account to comment, like comments, and keep a profile. There is no separate sign-up step: the first time you ask for a sign-in link, we create the account. When you have an account, we store:

• your email address, and when you confirmed it
• a password, only if you choose to set one. We store it as a one-way scrypt hash, never as the password itself.
• your handle. When we create your account, we suggest one based on the part of your email address before the "@". You can change it in your profile settings.
• the profile details you choose to add: a display name (up to 80 characters), a tagline (up to 140 characters), and a profile photo
• whether your profile is public or members only (public by default)
• account status details, like your role, whether the account is disabled, and when it was created and last updated

To sign you in, we also keep:

• sign-in links: each link we email you works once and expires after 60 minutes. We store only a hash of the link's code, its expiry, and when it was used.
• sessions: when you sign in, we store a hash of your session code and when it expires (30 days after sign-in). Signing out ends the session. Your browser keeps the session code in a cookie (see the Cookie policy).

3) Comments and likes

If you comment or like a comment, we store:

• the comment text (up to 3,000 characters), the page you commented on and its title, and which comment you replied to (if any)
• when you posted it, when its text was last edited, and its moderation status (pending, approved, or rejected)
• for moderated comments, when it was moderated and by which team member
• for likes, which comment you liked and when

4) Profile photo

If you upload a profile photo (JPEG, PNG, WebP, AVIF, or GIF, up to 5 MB), we crop it, resize it into a few small square versions, and store those copies in Cloudflare R2. We don't keep the original file you uploaded. When you replace or remove your photo, we delete the stored copies of the old one.

If you don't upload a photo, the site shows a picture generated from your initials instead.

5) Communication metadata

If you contact us, we may retain metadata such as:

• date/time of your message
• delivery status
• and basic email headers (as typical with email communication)

6) Site usage data (analytics, optional)

We use Google Analytics, and only after you accept analytics in the cookie banner. If you opt in, we may collect usage data such as:

• pages visited (the page address and title)
• approximate device/browser details
• general referrer information (for example, direct vs search)
• interactions, like clicks on navigation, buttons, and links to other sites, the start and submission of forms (which form, not what you typed), searches on this site (with email addresses and long numbers removed from the search term), and use of tools and checklists
• for the Freelance Health Check, your overall result band and score (not your individual answers)
• a random analytics ID stored in a cookie, so visits from the same browser can be counted together

We don't send your email address, account ID, comment text, or the numbers you enter into calculators to Google Analytics.

If your browser blocks the Google Analytics script, the site may send the same events to Google through our own server instead. In that case our server passes along your IP address and browser user agent so Google can work out approximate location and device type. This only happens when your browser has the "accepted" analytics choice stored.

We use this data to improve navigation and content quality (for example, making it easier to find the right Codex page quickly).

Analytics are optional where consent is required. For details and controls, see:

• Cookie policy

7) Your cookie choice (consent record)

When you make a choice in the cookie banner, we save a record of it so we can show what you chose and when. The record contains:

• a random visitor ID created in your browser
• your choice (analytics on or off) and where you made it
• a one-way hash of your IP address (not the address itself)
• your browser's user agent string
• when you made or changed the choice

8) Server logs (security and operations)

Like most websites, our servers may log basic request information for security and performance, such as:

• IP address
• user agent (browser type)
• request timestamps
• requested URLs
• error logs

Sign-in activity is logged too: for example, when a sign-in link is requested, sent, or used, or a password sign-in fails. These entries can include your IP address, user agent, account ID, and the domain part of your email address (for example, "gmail.com").

These logs help us:

• detect abuse and attacks
• debug performance issues
• keep the site reliable

This is standard operational logging and is not used to build advertising profiles.

9) Cookies and local storage

We may use cookies and similar storage (for example, local storage) for:

• essential site functionality (keeping you signed in, remembering your cookie choice and country)
• optional analytics (if enabled with consent)
• saving your progress in checklists and tools. That progress stays in your browser and is not sent to us.

The full list of cookie names and how long they last is in the Cookie policy.

What is public

Some of what you add to Freelance Codex is meant to be seen by others. Before you post, it helps to know exactly what shows up where.

• Comments: approved comments can be seen by anyone who visits the page, signed in or not. Each comment shows its text, when it was posted, whether it was edited, its number of likes, and your display name (or handle), tagline, and profile photo, with a link to your profile.
• Likes: the number of likes on a comment is public. The list of who liked a comment is not shown.
• Your profile at /u/your-handle shows your display name, handle, tagline, and photo. A public profile can be seen by anyone and can appear in search engines. If you set it to members only, only signed-in members can see it, and we ask search engines not to index it.
• Profile photos are served from a public web address so they can appear next to your comments. Anyone with that address can load the photo, and browsers or caches may keep a copy for up to a year.

Setting your profile to members only does not hide your name, tagline, or photo on your comments. If you don't want to be identifiable, choose a handle and display name that don't reveal who you are, and skip the photo.

Your email address is never shown publicly.

How we use information

We use collected information for the following purposes.

1) Responding to requests and messages

If you submit a question or contact us, we use your information to:

• read your submission
• respond or follow up
• clarify details if needed
• and (in some cases) improve public content based on recurring questions

If you submit via Ask the Codex, we may use your question to create a public page (anonymized) if it is common and high-stakes. We do not publish identifying details.

2) Running your account and community features

If you have an account, we use your information to:

• email you sign-in links when you ask for them
• keep you signed in and check your password, if you set one
• show your profile, comments, and likes as described above
• review comments before they appear (when moderation is on) and deal with abuse, including disabling accounts that break the Terms

We only email you about your account when you ask for it (for example, a sign-in link). We don't use your email address for newsletters or marketing.

3) Improving content and site usability

Freelance Codex is designed as a maintained reference system, not a one-off blog. To improve it, we may:

• track which pages are most visited (aggregate)
• identify confusing navigation paths (aggregate)
• refine internal linking between related pages

This is part of keeping the site useful over time. If you want the editorial trust model, read:

• Editorial standards
• Review policy

4) Operating and securing the site

We use operational data (including server logs and essential cookies) to:

• keep the site functional and secure
• prevent spam and abuse (for example, with Cloudflare Turnstile checks when you request a sign-in link, post a comment, or send the Ask the Codex form)
• maintain performance and availability

What we do not do

To be explicit:

• We do not sell personal data.
• We do not build advertising profiles.
• We do not “track you across the internet” for ad targeting.

If we ever recommend tools or partners, we disclose relationships transparently:

• Disclosure policy

Legal bases and jurisdiction notes (plain-language)

Privacy obligations vary by jurisdiction (for example, the EU/UK, US states, and others). We are not providing legal advice here. Instead, we describe our practical approach.

Depending on applicable laws, we may rely on:

• consent (for optional analytics cookies, where required)
• legitimate interests (operating and securing the site, improving content)
• contractual necessity (responding to a request you initiate, and providing the account and features you sign up for)
• legal obligations (where applicable)

If you have jurisdiction-specific questions, contact us:

• Contact

Data sharing and third-party services

We may use third-party services to operate the site. Depending on the service, some information may be processed by those providers on our behalf.

These are the providers we currently use, and what they handle:

• Hetzner (hosting): the server that runs the site and its database, so it holds the account, profile, comment, and consent data described above, plus server logs.
• Cloudflare Turnstile (bot checks): runs on the sign-in link, comment, and Ask the Codex forms. Turnstile runs a check in your browser, and our server then sends the resulting token and your IP address to Cloudflare to confirm you're not a bot.
• Cloudflare R2 (file storage): stores the resized copies of your profile photo.
• Mailjet (email delivery): sends sign-in links (your email address and the link), and delivers Ask the Codex submissions to our inbox along with your confirmation email (your email address and everything you wrote in the form).
• Google Analytics (analytics, optional): receives the usage data described above, only if you accept analytics.

Each provider handles data under its own terms and privacy policy. We aim to keep third-party usage minimal and to prefer services that are reliable, privacy-conscious, and easy to explain.

We do not allow third-party services to use data for their own advertising purposes on our behalf (where we have control of the configuration), and we do not sell personal data to them.

If you email us directly, your message is handled by our email provider. If you want details about a specific provider used at a point in time, contact us:

• Contact

Publishing submissions (Ask the Codex) and anonymization

If you submit a question via Ask the Codex, your question may influence public content in one of three ways:

1. We answer privately (no publication).
2. We publish an anonymized Codex page based on the question.
3. We improve an existing page or tool based on the question.

If we publish:

• we remove identifying details (names, company identifiers, unique project markers)
• we do not publish your email address
• we do not publish private documents or sensitive personal data

However, anonymous does not mean “impossible to infer” in all cases. If your situation is uniquely identifiable, avoid sharing details you wouldn’t want public.

If you want something removed later, contact us:

• Contact

Data retention: how long we keep information

We aim to keep information only as long as needed to:

• respond to requests
• maintain site operations
• comply with legal obligations (if applicable)

Where the site itself sets a time limit, we say so below. Otherwise we don't list fixed retention periods, because needs vary. We keep data only as long as necessary for the purposes described above.

Retention principles

Our retention approach is:

• purpose-limited: kept only for the reason it was collected
• data-minimizing: we avoid collecting extra details and encourage you not to submit unnecessary sensitive information
• access-controlled: we limit who can access submissions and operational logs
• reviewable: we may delete or anonymize older material when it no longer serves a clear purpose

If you request deletion, we generally focus on removing data from active systems where feasible. Some copies may persist in logs or backups for a period; access is restricted and systems overwrite data as they cycle.

Accounts, profiles, comments, and likes

• Your account and profile details stay until the account is deleted. Changes you make in your profile settings replace the old values.
• Comments and likes stay until they are deleted, either because you ask us or because we remove them under the Terms. Removing a like deletes it right away.
• Sign-in links stop working after 60 minutes or once used. Sessions stop working after 30 days or when you sign out. The hashed records of past links and sessions stay with your account and are removed when the account is deleted.
• Old profile photos are deleted from storage when you replace or remove your photo.
• If we disable an account, it is signed out everywhere, but its data stays until it is deleted.

When an account is deleted, its sessions, sign-in link records, comments, and likes are deleted from the database with it. Deleting a comment also deletes the replies to it.

Cookie choice record

The consent record described above is kept so we can show what was chosen and when. It is updated if you make a new choice from the same browser. The copy in your browser is covered in the Cookie policy.

Form submissions and emails

Ask the Codex submissions are not stored in the site's database; they live in our inbox as emails, and Mailjet keeps delivery records under its own retention rules. We may retain submissions and email correspondence for a reasonable period to:

• respond to your request
• identify recurring questions to improve the Codex
• maintain a record of corrections and update history

Deletion requests work best when you share enough context to locate the right submission (for example, which message or related page). For published content, we may remove, edit, or further anonymize it depending on the request.

If you want your submission deleted (where feasible), contact us:

• Contact

Analytics (if enabled)

Analytics data is typically retained in aggregated form to detect trends and improve content. How long Google Analytics keeps event-level data depends on the retention setting in our Google Analytics account and on Google's own policies. You can opt out of analytics cookies via:

• Cookie policy

Disabling analytics cookies stops future analytics collection on this device/browser. It may not remove past analytics events that were already included in aggregated reporting.

Server logs

Operational logs are usually retained for a limited period for security and debugging purposes. Retention length may vary depending on operational needs and hosting configurations.

Security

We use reasonable safeguards to protect information, such as:

• access controls
• secure hosting practices
• spam/abuse protections on forms (where configured)
• passwords stored only as scrypt hashes, and sign-in links and session codes stored only as hashes
• a sign-in cookie that page scripts can't read and that is sent only over HTTPS on the live site

No system is perfectly secure. If you believe you’ve found a security issue, report it responsibly:

• Contact

Your choices and rights

Your rights depend on your jurisdiction, but we support reasonable requests related to data you submit.

Common requests include:

• access: “What information do you have from me?”
• correction: “This information is wrong.”
• deletion: “Please delete my submission.”
• account deletion: "Please delete my account and my comments."
• consent control: “I want to disable analytics cookies.”

1) Things you can change yourself

If you have an account, your profile settings let you:

• change your handle, display name, and tagline
• switch your profile between public and members only
• upload, replace, or remove your profile photo
• set or change a password

You can sign out from the site header, which ends your session. You can also remove a like by clicking it again.

There is currently no button to delete your account, delete or edit your own comments, or change the email address on your account. For any of those, contact us from the email address on the account and we'll handle it for you. Deleting your account also deletes your comments and likes.

2) Control analytics cookies

Use cookie preference controls (where available) or browser settings:

• Cookie policy

3) Request access, correction, or deletion

Contact us with:

• the email address you used (if applicable)
• the URL or context (what you submitted)
• what you want (access/correction/deletion)

We may need to verify the request to prevent unauthorized changes.

What happens after you contact us (in general):

1. We locate the relevant information (and may ask clarifying questions).
2. We may take steps to verify the request, especially for deletion or correction.
3. We fulfill the request where feasible, or explain practical limits.

We may keep a minimal record that a request was handled (for example, to prevent abuse), but we try to keep it limited.

Contact:

• Contact

FAQ

Do you sell personal data?

No. We do not sell personal data, and we do not build advertising profiles.

Do you use targeted advertising or “track me across the internet”?

We do not configure Freelance Codex to track you across other websites for ad targeting. Some third-party services may process limited data to provide infrastructure, but they are used to operate the site, not to build advertising profiles.

Are my comments public?

Yes. Once approved, a comment can be read by anyone, along with your display name (or handle), tagline, and profile photo. This is true even if your profile is set to members only. See What is public.

How do I delete my account or a comment?

Use the contact page and write from the email address on your account. There is no self-serve delete button yet. Deleting your account removes your profile, comments, and likes.

Can I use Freelance Codex without optional analytics?

Yes. Where consent is required, analytics are optional and are controlled via cookie preferences. Essential cookies (and basic operational logging) may still be used for security and basic site functionality.

To learn more or change your settings, see the Cookie policy.

What should I avoid submitting in a form or message?

Avoid sharing sensitive personal information that is not needed to answer your question. If you’re asking about a situation involving a client or employer, consider removing or generalizing details that could identify them (or you).

If I submit a question, will it be published?

Not necessarily. If you submit a question via Ask the Codex, we may answer privately, publish an anonymized page based on a common question, or use the submission to improve existing content. If we publish, we remove identifying details and do not publish your email address.

How do you handle requests to remove published content?

If a published page appears to include identifying details or you want it removed, contact us with the URL and context. Depending on the situation, we may remove the page, edit it, or further anonymize it. If search engines have cached older versions, we may not control how quickly those caches update.

How do I make a privacy request (access, correction, deletion)?

Use the contact page and include the email address you used (if any) and enough detail to find the relevant information. We may ask follow-up questions to verify the request or locate the right submission.

Children’s privacy

Freelance Codex is intended for adults and professional use. We do not intentionally collect personal information from children. If you believe a child has provided personal information, contact us and we will address it:

• Contact

International users

Freelance Codex may be accessed from multiple countries. Depending on where services are hosted and where you are located, information may be processed in different jurisdictions. The providers listed under Data sharing may process data in countries other than yours.

If you have a question about cross-border data handling, contact us:

• Contact

Changes to this policy

We may update this privacy policy as the site evolves. When we make material changes, we will update the policy and its “last reviewed” date.

For how we handle content maintenance generally, see:

• Review policy

Questions or requests

For any privacy question or request, contact:

• Contact