Who is responsible
The controller for this website and for correspondence that starts from it is:
- Company
- MF DG LTD
- Number
- 123779
- Incorporated
- 26 September 2023, Gibraltar
- Contact
- mf@foragers.io
What this site does not do
- No cookies, local storage or fingerprinting for tracking. The one thing kept in your browser's local storage is your choice of light or dark mode, if you switch it. It stays on your device and is never sent to us.
- No advertising pixels, and no analytics shared with an ad network.
- No form submissions. The contact controls only prepare a draft in your own email client, or copy the same text to your clipboard. That happens in your browser.
- No third party fonts, embeds or scripts beyond our own analytics described below.
Analytics
We count visits with Plausible, self-hosted on our own server at analytics.degruytere.com. It records the page you viewed, the referring site, any campaign tags in the link (UTM parameters), your browser, operating system, device type and country, and a small set of events: which buttons and links were clicked, how far the page was scrolled and which sections came into view, time on page (counted only while the tab is visible), and use of the interactive chart. Events never contain your name, email address, or anything you type.
Plausible does not store your IP address. To count unique visitors it combines the IP address and browser string with a salt that is replaced every day, then keeps only the resulting hash, so a visit cannot be linked to you or to your visits on other days. We use these numbers to learn which parts of the site and which campaigns are useful. The legal basis is our legitimate interest in running and improving the site.
Hosting
The site is a set of static files served from our own server by the Caddy web server. We do not keep access logs of page views. If a request fails with an error, the server may log its IP address, time and requested address. We use these error logs only to keep the site running and secure, and we do not combine them with analytics or with correspondence.
When you contact us
If you message us on Signal, write to us, or speak with us on a call, we keep what we need to reply and, if we work together, to run the engagement. The legal basis is taking the steps you asked for before a contract, and then the contract itself.
- We do not sell correspondence and we do not use it for advertising.
- We do not put your repo, threat model, data or drafts on a public page.
- Specialists from our bench, or a lawyer, see your material only once they are on your engagement, under the same confidentiality terms we are.
- Ask us to delete a thread and we will, unless we must keep it for a live contract, a dispute or the law.
Signal messages are end-to-end encrypted by Signal. Email is handled by our email provider under its own terms.
When you book a call
Booking links open book.foragers.io, a scheduling page we run ourselves on our own server with the open source Cal.diy software. To book, you give your name, email address, the time you pick, your time zone and anything you choose to write in the notes. We use this to hold the call and to send you a confirmation and any change to it. Confirmation emails are sent through our email provider. The legal basis is taking the steps you asked for before a contract.
The booking page loads nothing from other sites and runs no analytics or advertising scripts. It sets three cookies that end when you close your browser: two protect the form against forged requests, and one holds the time you picked while you fill it in. It also remembers your clock and display preference in your browser. You can cancel or reschedule from the link in your confirmation email, and ask us to delete a booking at any time.
Links to other sites
Links to Signal, GitHub and Wikipedia take you to services with their own privacy policies. Their policies apply once you are there.
Your rights
You can ask for a copy of the data we hold about you, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Write to mf@foragers.io. We answer within one month.
You can also complain to the Gibraltar Regulatory Authority, which acts as the Information Commissioner in Gibraltar, or to the data protection authority where you live.
Engagements and changes
This policy covers the public website. Client work runs under its own written scope, and under an NDA where the work needs one. If this policy changes, the date at the top changes with it.