Privacy Policy

Traditional developer recruitment platforms harvest resumes, monitor keystrokes, and trade candidate profiles across shadowy lead lists. DevLedgr was created to build a clean cryptographic ledger for software engineers.

We adhere to data minimization principles: we collect only what is strictly required to verify that your code solves realistic systems problems, generate verifiable SHA-256 commit hashes, and host your 365-day public proof portfolio.

We collect information in three categories:

DevLedgr utilizes collected information exclusively for the following operational purposes:

• Challenge Verification: Recording the test results a reviewer measured against your submission, and generating the signed certificate that accompanies a verified entry. DevLedgr does not currently run automated test harnesses; see section 3.3 of the Terms for the current state and planned direction;
• Cryptographic Stamping: Calculating and timestamping immutable SHA-256 commit hashes and Ed25519 signature guarantees;
• Public Portfolio Hosting: Serving your verifiable developer portfolio at /p/[username] for 365 days;
• ATS-Safe Resume Generation: Translating your recorded proof-of-work into recruiter-readable Markdown CV packages. Only measured figures are included; entries with nothing measured are described without performance claims rather than being given estimated numbers;
• Algorithmic Job Matching: Comparing your recorded technical results against requirements in company requisitions;
• Security & Abuse Prevention: Detecting abuse of the platform, including attempts to misrepresent proof of work.

Transparency is central to the DevLedgr ledger, but personal privacy is equally sacrosanct. Here is the clear demarcation of what is public versus what remains strictly confidential:

When our AI Scrutiny engine evaluates your architecture or drafts an ATS-compatible resume, your code snippets are transmitted to model inference endpoints (such as Google Gemini via Google Cloud Vertex or OpenAI API) under enterprise data-privacy terms where data retention for model improvement is disabled by default.

DevLedgr offers a first-class Bring-Your-Own-Key (“BYOK”) tier for developers who wish to retain absolute ownership over their AI compute:

• Local / Encrypted Storage: Your API keys are stored within your browser's secured local storage or encrypted in memory during transient API calls.
• No Centralized Harvest: We do not log, persist in plaintext databases, or aggregate BYOK keys across users.
• Instant Revocation: You can clear or update your key at any moment with one click in your Account Settings.

We do not share your personal information except with trusted service providers who assist us in operating our platform:

• Supabase: For enterprise authentication, session tokens, and database infrastructure.
• Cloud Runner Fleets: Containerized Linux environments orchestrating isolated test suites.
• AI Gateway Providers: Google Cloud and OpenAI for code scrutiny and CV compilation.
• Verified Employers & Recruiters: Only when you affirmatively submit a solution to an employer-sponsored problem or authorize candidate matching outreach.
• Legal Compliance: When required by lawful summons, court order, or to prevent immediate physical harm or cyberattacks.

8.1 365-Day Portfolio Validity: Successful ledger entries are guaranteed to be verifiable at your canonical URL for 365 days from the date of consensus stamping. Following the 365-day active period, you may re-stamp your solution or archive the record.

8.2 Test Logs: DevLedgr does not currently execute submitted code, so no execution logs are generated. If automated verification is introduced later, raw stderr and standard output from failed attempts will be purged after 30 days.

8.3 Account Deletion: If you delete your account, your profile, contact email, and private drafts are purged within 14 business days. Public cryptographic hashes already signed into the immutable ledger may remain indexed in an anonymized, detached form to preserve network consensus integrity.

Regardless of where you reside, DevLedgr extends comprehensive privacy rights to all developers:

To exercise any of these rights, email our data desk at privacy@devledgr.xyz.

DevLedgr does NOT use third-party behavioral advertising cookies, Facebook pixels, or invasive surveillance scripts. We use strictly necessary and functional browser storage:

• sb-auth-token / devledgr_session: Secure HTTP-only cookies maintaining your authenticated developer session.
• devledgr_storage_v1: Client-side local storage storing your selected theme (dark/light) and active UI preferences.

We implement layered defense-in-depth security to protect your code and telemetry:

• All network communications are encrypted in transit via TLS 1.3 with strict HSTS enforcement;
• Database instances utilize AES-256 encryption at rest with automated backup snapshots;
• Submissions are not executed by DevLedgr today. If we introduce automated verification, untrusted code execution is intended to run under non-root ephemeral containers with seccomp, AppArmor, and disabled network access. Those controls are not currently in place because there is no execution environment to apply them to;
• Root consensus signing keys are isolated in hardware security modules (HSM) or encrypted secrets managers with multi-party access control.

DevLedgr operates globally. By using the platform, you acknowledge that your information may be processed on servers located in the United States, the European Union, and other cloud provider regions. Where data is transferred across international borders, we ensure appropriate safeguards including Standard Contractual Clauses (SCCs) are in effect.

DevLedgr is designed for software engineers and is not intended for children under the age of 13 (or under 16 in the EEA/UK). We do not knowingly collect personal data from minors. If you believe a minor has registered an account without parental consent, please notify us immediately at privacy@devledgr.xyz.

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your telemetry and cryptographic proofs, our Data Protection Officer is directly reachable: