CodeRef collects as little as it can. Most tools run entirely in your browser and never send what you type to us.
In short
- We collect your email and what you choose to save. We don't see your card details.
- We use analytics to see which pages are useful. No ads, no selling data, no marketing email.
- You can delete your account and all its data at any time.
- Questions: support@coderef.xyz.
Who we are
CodeRef (coderef.xyz) is the service provider and the party responsible for the personal data described here. Contact us at support@coderef.xyz. More about the site is on the About page.
What we collect
- Account: your email address, when you created the account and last signed in.
- Saved items: the palettes, requests, documents and favourites you choose to save.
- Billing status: your plan, its status and renewal date, and the customer and subscription IDs from our payment provider. Payment records (amounts, dates, payment IDs) are kept so we can show your billing history and invoices. We never see or store card details.
- Emails we send you: sign-in codes and, once you have a paid plan, messages about your subscription (renewals, cancellations, failed payments, refunds). We don't send marketing email.
- Security logs: IP addresses are used briefly to rate-limit sign-in codes and prevent abuse.
- Analytics: Google Analytics and Microsoft Clarity measure how pages are used (pages viewed, clicks, device type). They set their own cookies.
CodeRef Start and the browser extension
- Start pages: the pages, widgets, links, notes and to-dos you add are stored in your account. Team pages are visible to the members of that team; public pages to anyone with the link.
- Connecting the extension: the extension signs in with an access token that only works for your start pages. We store only a fingerprint (hash) of it, the device name you see on the connect page, and when it was last used. You can remove it any time on the connect page or in your account.
- What the extension sends us: only what you ask it to save: the title and address of the current tab or of every tab in the window when you press Save, a link you right-click, or your bookmarks when you press Import. It talks only to coderef.xyz.
- What stays in your browser: a copy of your pages (so new tabs open instantly), your settings, saved tab sessions, a picture you upload as a background, and your most visited sites, which the extension reads from Chrome to show as shortcuts. None of these are sent to us.
- Link clicks on team pages are counted per link per day for the team's analytics, without recording who clicked. The counter uses your IP address briefly to prevent abuse.
- Third parties: site icons are loaded from Google's favicon service, which receives the domain name of each site shown. Background photos are loaded from Unsplash. Feeds and weather are fetched through coderef.xyz, which passes the feed address or the chosen city's coordinates to that feed or to Open-Meteo.
- Removing the extension deletes everything it kept in your browser.
Cookies
Signing in sets one cookie, cr_session, that keeps you signed in for 30 days. It is HttpOnly (scripts can't read it) and used for nothing else. Tools also remember your last work in your browser's local storage, which never leaves your device unless you save to your account. Analytics services set their own cookies. The full list, with durations and how to control them, is in the cookie policy.
Who processes data for us
- Vercel: hosting.
- Neon: the database that stores accounts and saved items.
- Amazon Web Services (SES): sends sign-in codes and account emails, from noreply@mail.coderef.xyz.
- Dodo Payments: payments, taxes and receipts, as merchant of record.
- Google Analytics and Microsoft Clarity: usage analytics.
Why we use your data
- To provide the service you asked for: your account, saved items, sign-in and billing.
- To keep CodeRef secure and prevent abuse, which is in our legitimate interest.
- To understand which pages are useful, through analytics (see the cookie policy).
- To meet legal obligations such as tax records. We never sell your data or use it for advertising.
When we share data
We share data only with the providers listed above, and only what each needs to do its job. We may also disclose information if the law requires it, to enforce our terms, or to protect the security of CodeRef and its users. If CodeRef is ever sold or merged, account data may move to the new owner, and we will tell you first.
Information you share publicly
Saved items are private unless you turn on a share link. Anyone with the link can view that item until you turn sharing off, so don't put secrets in items you share.
Third-party links
Pages link to official documentation and other sites. Their privacy practices are theirs, not ours, so check their policies.
Where data is stored
Our providers run in several countries, including the United States, so your data can be processed outside your own. We rely on each provider's standard contractual and security commitments for those transfers.
Your choices and rights
You can delete your account and everything saved in it at any time from Settings; this also cancels any subscription (see the cancellation policy). Turning off a share link makes it stop working immediately. Depending on where you live you may also have the right to access, correct, export or erase your data and to object to some processing. To use any of these, or for any privacy question, email support@coderef.xyz. We reply within 30 days. We won't treat you differently for using these rights. If you are in the EU, UK or a similar region and aren't happy with our answer, you can also complain to your local data protection authority.
Security
Connections use HTTPS, sign-in codes and sessions are stored only as one-way hashes, and saved items are accessible only from your account or a share link you turn on. No system is perfectly secure, so keep access to your email inbox safe.
Children
CodeRef is for developers and isn't directed at children under 16. If you believe a child has created an account, email us and we'll delete it.
Retention
Account data is kept until you delete your account. Billing records are kept by Dodo Payments as tax law requires. Expired sessions and sign-in codes are removed automatically. Rate-limit counters are deleted or overwritten within hours. Deleted accounts are removed from our database immediately.
Changes
If we change this policy in a way that matters we'll update the date above and, for material changes, tell signed-in users by email.