Privacy policy

1. Scope and responsibility

Medivh Code operates medivhcode.com. This policy covers the public website, inquiry forms, article comments and authenticated website management. Data handling for an agreed client project must be defined separately before project data is shared.

2. Information we collect

Required form information includes your name, email address, project goal, the problem to solve, expected output, preferred timeline, and consent. Optional information includes your company, target audience, budget range, and constraints.

The backend also stores a request identifier, submission time, processing status, a content fingerprint, and submission keys used to prevent duplicate requests. To limit abuse, it creates a short-lived hash from the request IP address and minute of receipt. The application’s rate-limit table does not store the raw IP address.

Comments collect a display name, comment text, article identifier and submission time, without an email address. They stay private until a moderator approves them; an approved display name and comment are public. A daily secret-salted IP hash supports temporary comment rate limits; raw IP addresses are not stored by the application. The site also records aggregate daily counts of successful public HTML requests by page, without visitor identifiers, cookies or individual browsing histories. These are not unique-visitor measurements. Hosting infrastructure may process IP addresses, request metadata, and operational logs to deliver and protect the service. Please avoid submitting credentials or sensitive personal information.

3. Why we use information

We use inquiry information to assess your request, understand the proposed work, and contact you about it. Technical records support delivery, duplicate prevention, abuse controls, comment moderation and aggregate page-request reporting. Submitting a brief does not authorize payment, a project, or public release.

4. Storage, access, and service providers

Inquiries are stored in the website’s backend database, hosted through Sites on Cloudflare infrastructure. Administrative access requires a permitted platform identity and a separate password session with owner, editor or moderator permissions. Submitted briefs have no public read endpoint. Uploaded management images are private unless the owner explicitly makes an image public.

Hosting service providers process information as needed to operate the website. This application does not sell submissions, send them to advertising services, or automatically forward them to n8n, OpenAI, or Anthropic. We have not specified a guaranteed storage country for this service.

5. Cookies and browser storage

We have not added advertising cookies, third-party analytics scripts or cross-site tracking. Authenticated management uses a necessary Secure, HttpOnly, SameSite cookie that expires after eight hours; logging out, password changes and access revocation invalidate applicable sessions. Anonymous page-request counts do not use a visitor cookie. The form keeps a retry identifier in page memory while a submission is pending; it does not persist your brief in local storage. Hosting and security infrastructure may use its own necessary technical mechanisms.

6. Retention and security

There is currently no automatic retention or deletion schedule for inquiry records and their duplicate-prevention metadata. Inquiries and comments remain until an authorized operator removes them or a separate arrangement applies. Aggregate counts and activity records also remain until administratively removed. Management provides manual content export and reviewed import; this is not a full infrastructure backup service. Inquiry rate-limit records older than two minutes and comment rate-limit records older than one hour are cleaned up when later relevant submissions are processed; these are not continuously running cleanup services.

The form uses HTTPS, server-side validation, request limits, and duplicate controls. Secret-pattern checks are limited and cannot identify every sensitive value. No online service can guarantee absolute security; share only what is needed for an initial discussion.

7. Access, correction, and deletion requests

Use our contact form to request access to, correction of, or deletion of an earlier inquiry, or to ask us to stop contacting you. For an inquiry, identify the email used and, if available, its receipt identifier. For a comment, identify the article, display name and approximate submission date. Describe the request in the project fields without repeating sensitive material.

We may ask for enough information to verify that the record belongs to you. These requests are handled manually, not by an automated deletion endpoint. Applicable obligations may affect whether particular records can be removed.

8. Policy updates

We will update this page when the website’s handling practices change. The date above identifies the current version. Owners may configure Gemini or Grok for English editorial drafts after explicitly approving the provider and cost limits. Requests contain editorial instructions and public article titles and slugs, not inquiries, comments, administrator accounts or traffic records. Provider keys are encrypted in the backend and are never returned through the management API or content backups. Generated sources and claims require independent editorial review. When the owner approves automated publication, a separate reviewer checks the exact draft, primary sources, claims and links before it can be published. Unverified drafts remain unpublished. A configured provider applies its own data and retention terms. Questions about this policy can be submitted through the contact form.