Privacy Notice

This notice explains how personal data is handled when you visit deftmove.com, read its public content, use its forms, subscribe to the DeftMove newsletter, create or use an account, pay for a membership, comment, take a course, or use the CV builder, the goal planner or the focus timer.

Who is responsible

DeftMove by EverKnight is a learning platform for software engineers who want to keep getting better, move into better roles, or turn their ideas into products. Its learning focus includes practical software engineering, AI and machine learning for everyday work, and interview preparation. It is operated by EverKnight Limited. EverKnight Limited is responsible for the personal data described in this notice and is referred to below as “we”, “us” or “our”.

• Privacy contact: info@deftmove.com

Information we collect

When you visit the platform

Cloudflare processes network, request and security information needed to deliver and protect the site. This can include your IP address, browser or user-agent information, requested page, date and time, TLS or device signals, and security outcomes.

The application reads your IP address when you submit the contact or newsletter forms, confirm a newsletter request, sign up, authenticate, or request password recovery. It uses the address for short-term rate limiting. It also passes the address to Cloudflare Turnstile when verifying contact, newsletter, signup and login submissions. Newsletter confirmation and recognised-browser unsubscribe actions are rate limited without another Turnstile check. The application does not add your IP address to contact messages, newsletter subscriber records, application account records, or premium entitlement records.

Anonymous reading counts: to show how many people read an article or story, the page tells the server once when it has been open for about 15 seconds or scrolled halfway (or when you open a story’s publisher link); the server keeps only the page, the date and a one-way hash of your IP address and browser made with a key that changes every day, so a visit can be counted once per day but cannot be traced back to you. The hash is stored in our database (Supabase) for at most about two days and then deleted; only the daily number of readers per page is kept. No cookies or browser storage are used.

Visitor statistics (Cloudflare Web Analytics): our public reading pages (articles, topics, news, courses and lessons, the CV builder and goal planner pages, the membership page and the Premium library) load a small script from Cloudflare that reports the visit to Cloudflare Web Analytics: the page address, the site you came from, your country, browser, operating system and device type, and how quickly the page loaded. Cloudflare uses this to give us totals such as the number of visits and page views per page, referring site and country; we see only those totals and do not store them in our database. We do not set any cookie for it. Cloudflare describes Web Analytics as privacy-first and states that it does not collect or use visitors’ personal data. Account pages, sign-in, sign-up and password pages, newsletter confirmation and unsubscribe pages and error pages do not load it.

When you use the contact form

The contact form requires your:

• name;
• email address;
• selected topic;
• subject; and
• message.

The form also generates a submission identifier and a Turnstile security token. This information is used to validate the request, prevent duplicate delivery, send the message and reply to you. Please do not include passwords, financial information, health information or other sensitive personal data in your message.

The application does not keep contact messages in its own database. Valid messages are sent through Resend to the mailbox used by DeftMove, where they may be retained as correspondence.

When you subscribe to the newsletter

The newsletter form collects your email address and a Turnstile security token. Your email address is normalised to lower case before it is stored in Supabase with:

• a subscription status, initially pending;
• the source of the request and a version identifier for the consent wording;
• the date and time of your request;
• a SHA-256 hash of the current one-time confirmation token and its expiry; and
• record creation, update, confirmation, revocation or unsubscribe timestamps, where applicable.

The confirmation token itself is not stored in Supabase. While a request is pending, its stored hash cannot be used at or after the 24-hour expiry; a later request can replace it, and retention cleanup can delete the pending record. After successful confirmation, the consumed hash and its timestamps remain with the subscribed or later unsubscribed record under the retention approach below. A usable pending challenge starts a five-minute cooldown from the time it is requested. Another request for the same pending address during that period leaves the challenge unchanged, regardless of the email-provider result.

An accepted form submission can create or refresh a pending newsletter request. Resend receives the pending email address, and the application asks it to send a one-time confirmation message. The link carries the raw token in its URL fragment; the confirmation page removes it from the address bar and submits it only after you explicitly select the confirmation button. The application hashes the submitted token and activates the subscription only when it matches a current, unrevoked and unexpired challenge. An existing subscribed address or a pending request inside the cooldown remains unchanged.

The DeftMove newsletter is sent about once a month to confirmed subscribers. We write and schedule each issue; a scheduled job reads the confirmed subscribers’ email addresses from Supabase and sends each person their copy through Resend, keeping a delivery record for each recipient (whether the message was sent, retried or failed). Each issue contains a personal unsubscribe link that works without signing in, including one-click unsubscribe from email apps that support it.

An email address that belongs to a paying member is not kept on the free newsletter: when a payment is confirmed, or when that address asks to subscribe, any free subscription for it is ended and no confirmation email is sent. Ending a membership does not resubscribe you; you can sign up again yourself.

The newsletter interface displays its request-accepted state only on the currently loaded page. It does not store the submitted email address or a newsletter cooldown marker in browser storage.

When you create or use an account

You can create a free DeftMove account by submitting your email address, a plan choice (free, monthly or annual), and a security token. We send an email verification link; you then verify your email and choose a password. Supabase stores the Auth identity and related application account. A monthly or annual choice is carried through the account setup links and forms so you can continue to checkout; a free choice is not stored. Neither creates a charge, subscription or premium entitlement.

An authorised operator can separately grant premium access to an account and may set an expiry date. This stores the related premium entitlement in Supabase.

Account and entitlement information can include:

• your normalised email address and a Supabase Auth user identifier;
• the display name you choose, if any (optional; you can change or remove it on your account page; it is shown to you in your account area and account menu, and to DeftMove staff in our administration app, beside your email address, when they view members and course learners);
• the theme colour you choose for the site if you have Premium (otherwise the default colour is stored; the choice is kept if Premium ends and is used again if you renew);
• the reading font and text size for article and lesson text that you save to your account if you have Premium (otherwise the defaults are stored; the choice is kept if Premium ends and is used again if you renew);
• whether you get member emails, and, if you opted in, when you did and which version of the wording you agreed to (see When you get member emails);
• whether the email has been verified;
• the account status and activation, suspension or closure timestamps;
• the premium entitlement status, source, start, expiry and revocation timestamps;
• internal record identifiers, state versions, creation and update timestamps; and
• authentication and security records maintained by Supabase Auth, such as sign-in and session information.

Supabase Auth sends account verification/invitation and password-recovery messages through its configured transactional email service. Those links contain one-time authentication material in the URL fragment. The callback page removes that material from the address bar and requires an explicit submission before it is verified. Successful signup and password-recovery responses are deliberately generic so that the public forms do not reveal whether an address has an account.

When you submit a password, the Worker handles it only as needed to authenticate you or send the update to Supabase Auth. The application does not store the plaintext password in its own database, cookies, or browser storage. Supabase Auth is responsible for storing and verifying authentication credentials.

After authentication, the application stores access and refresh tokens in protected browser cookies so it can maintain and refresh your session. When you request an account or premium page, the application verifies the session and checks the current account and entitlement state in Supabase. The account page displays your email, any display name you set, account status, premium-access state and any access expiry.

An account and a newsletter subscription are independent. Joining the newsletter does not create an account or premium entitlement, creating an account or receiving an invitation does not subscribe you to marketing, and changing either status does not automatically change the other, except that an address that gets member emails is left out of the newsletter (see When you get member emails), and that you can choose to unsubscribe when you close your account (see Closing your account).

When you get member emails

Member emails are The DeftMove weekly and other emails for DeftMove members. With a free membership we send them only if you opt in: either by ticking Email me The DeftMove weekly when you sign up, or by turning on Member emails on your account page. A signup choice is recorded with your pending account and counts as your consent only once you verify your email; until then, and if you never verify, no member email is sent. With a paid membership, member emails are on unless you turn them off.

We store, with your account in Supabase, whether member emails are on, when you opted in and which version of the opt-in wording you agreed to. When you turn member emails off, from your account page or the link in each email, we stop sending them and keep the record of your earlier opt-in to show that consent was given. Member emails are sent through Resend with your email address; delivery records are kept as described below. While you get member emails, your address is left out of the newsletter, so you do not receive both.

When you pay for a membership

Payments are handled by Stripe. When you first start checkout from your account page, we create a Stripe customer for your account and send Stripe your account email address and our internal account identifier; the checkout we open also carries the plan you chose and a checkout reference. You then enter your card details on Stripe’s own checkout page. We never receive or store your card number, expiry date or security code.

Stripe tells us, through signed messages, when an invoice is paid, a payment fails or a subscription changes. We check each message with Stripe and store in Supabase only what we need to run the membership:

• the Stripe customer reference linked to your account;
• your subscription’s reference, plan price, status, current billing period, whether it is set to end at the period’s close, and when it was created and changed;
• for each paid invoice: its reference, the membership period it pays for, when it was paid and whether it was later revoked;
• a record of your latest checkout attempt: your account, the plan and price, the email address used for checkout, the Stripe checkout reference and when it was started and expires; and
• a receipt for each Stripe message we receive: its reference, kind, the invoice or subscription it concerns, and when it was created, received and processed.

We do not store full Stripe messages, card details or bank details. Premium access from a membership comes only from a paid invoice period: when you open premium content, we check that your account has a paid, unrevoked period covering the current time (or a separate access grant from an operator).

Manage billing on your account page opens Stripe’s billing portal for your own Stripe customer, so you can update your payment method, see your invoices or cancel. We create the portal session only for the customer linked to the account you are signed in to. The link appears only once your account has a Stripe customer.

Stripe processes this information to provide the payment service for us. It also uses it for its own purposes, such as preventing fraud and meeting its financial and legal obligations, as an independent controller under the Stripe Privacy Policy. Stripe sets its own cookies on its checkout and billing pages; this site does not load Stripe scripts.

When you save items

Any signed-in member, with a free or paid membership, can save articles, courses and news stories. We store, with your account in Supabase, which items you saved and when. Your saved items are private to you, are not shown to anyone else, and are deleted when you remove them or when your account is deleted.

When you react or rate a course

Signed-in members can react to articles and news stories (Like, Insightful or Love it) and rate courses they have started (1 to 5 stars). We store, with your account in Supabase, which item or course, your reaction or stars, and when you gave and last changed them. Nobody else, DeftMove staff included, can see who reacted or rated: pages and our administration app show only totals (counts per reaction, the number of ratings, the average and how many gave each number of stars), which we recount every 15 minutes. You can change or remove a reaction or rating at any time; they are deleted when your account is deleted.

When you comment

When you post a comment we store, with your account in Supabase, the comment’s text, the article or story it is on, the comment it replies to, when it was posted and last edited, and its status (published, waiting for approval, removed or deleted). We also store a fingerprint of the text (a hash) to refuse the same comment twice within 24 hours, and count your recent comments to limit abuse. Each comment is shown publicly (on Premium articles, to Premium members) with your public name (your username, or your display name with your username), your profile picture and the time; your email address is never shown.

If you report a comment, we store your account, the reason, any details you add and when you reported it; the author is not told who reported it. When our moderators act, we record what they decided, the reason for a removal (which the author can see) and, for a ban from commenting, an internal reason and its dates. DeftMove staff see comments, reports and bans in our administration app with the account’s email address, to moderate them.

Account activity records

We keep a record of important actions on each account, so we can keep accounts secure, detect and prevent fraud and abuse, account for what our staff do, and show when you gave or withdrew consent. Each record holds what happened (for example a sign-in, a failed sign-in with a password that didn’t match, a sign-out, a password reset request or change, signing up and activating the account, a username, display name or profile photo change, turning member emails on or off, a checkout, a Premium payment, renewal, cancellation or failed payment reported by Stripe, a redeemed Premium code, posting, editing, deleting or reporting a comment, closing the account, and what DeftMove staff did to the account, with the reason they gave), when it happened, who did it (you, a named member of DeftMove staff, Stripe or our automatic systems), the country your request came from, a coarse description of your browser and device system (such as “Firefox on macOS”) and Cloudflare’s request reference. It never holds your password, your email address, the text of your comments or what you write in the CV builder or goal planner. A failed sign-in is recorded only when the email belongs to an account.

You can see your own sign-ins, failed sign-ins, sign-outs and password changes of the last 90 days on Account → Security activity. DeftMove’s owner and administrators can see an account’s full record in our administration app. Records can’t be changed; they are deleted 24 months after the event, also after your account is deleted.

When you take a course

To read a course’s lessons you enrol in it while signed in. We record in Supabase, with your account, which courses you enrol in and when, when you leave a course, and each lesson you mark complete and when, plus the date you finished a course if you complete every lesson. We use these records to let you read the course and to show your progress: the progress bar, the ticks in the course outline, where to continue, and your courses in My learning.

DeftMove staff can see these records in our administration app, for each course: your email address, display name (if you set one) and account identifier, when you enrolled, your progress and completed lessons, and when you were last active. They use them only to run and improve the courses.

Leaving a course hides it from My learning but keeps your progress, so it is restored if you enrol again. Reset progress on a course deletes its completed lessons straight away. Your enrolments and progress are kept with your account until you reset them, and are deleted if your account is deleted.

When you use the CV builder

If you use the CV builder, we store the CVs you write with your account in Supabase; an account can keep up to three. Each includes the contact details, links, summary, work history, education, skills, projects and certifications you enter, the template, colour and page size you choose, the private name you give it (which is never printed on the CV), and when it was created and last changed. The CV is saved automatically while you edit it. It is shown only to you when you are signed in; it is not published or shared, and we do not use its contents for any other purpose.

When a Premium member downloads a CV, the platform sends the CV as a self-contained page to Cloudflare Browser Run, which turns it into a PDF and returns it to your browser. The page cannot load anything from the internet while it is being converted, and we do not keep a copy of the PDF. To limit misuse, downloads are rate limited per account.

If you use the CV builder without an account, your draft is kept only in your browser’s local storage on that device; it is not sent to us. It is removed 30 days after your last change, may be cleared sooner by your browser, and is deleted if you clear this site’s data. If you then sign in, the draft is added to your account as a new CV (or, if your account already has three, you choose one to replace or discard the draft) and removed from the browser.

You can change anything in a CV at any time by editing it, and delete a CV from the builder’s CV menu; a deleted CV is removed permanently and cannot be recovered. You always keep at least one CV while your account exists. All your CVs are deleted if your account is deleted.

When you use the goal planner and focus timer

If you use the goal planner with an account, we store your plans in Supabase: their names, target dates and template, and each goal and task you add, including a goal’s type (custom, its topics, or the course it follows) and any web address you add to it, and a task’s notes, estimates, priority flags, repeat settings, whether it is a quick task, when it was done, and the articles on this site you link to it. Every account also has one everyday area, created when you first open the planner, holding tasks you keep outside your plans (one Inbox, including quick tasks, with the day each task was added). We also store your planned days: the tasks you put on each day and whether you have reordered them, your top task, time blocks, and the two lines you write in an evening review, with when you wrote them. These are shown only to you, are not published or shared, and are used only to run the planner and show you your own stats.

When you finish a focus round while signed in, or end one after at least a minute, we record when it started and ended, its length (for a round you end early, the whole minutes you focused), the planner task it counted towards (or that it was General focus), and the article it ran on, if any. Rounds you end within the first minute are not recorded. Focus on articles that you don’t count towards a task is recorded as General focus unless you turn off Record focus I do outside my plans in the planner’s settings; we also store your timer lengths, that choice and the time your day ends. The planner calculates your stats (such as focus time, streaks, progress and estimate accuracy) from these records when you open them; it does not share them or use them to profile you for any other purpose.

If you use the goal planner without an account, your plan (one plan with one goal), your everyday area’s tasks and your days are kept only in your browser’s local storage on that device; they are not sent to us, and focus rounds are not recorded. They are removed 30 days after your last change, may be cleared sooner by your browser, and are deleted if you clear this site’s data. If you then sign in, the plan is added to your account as a new plan, the everyday tasks join your account’s everyday area, the days are merged into yours, and the browser copy is removed; if your account has no room for another plan, you can keep it in the browser for later or discard it.

You can change or delete any plan, goal, task or day entry at any time; the everyday area itself stays (you can delete its tasks) until your account is deleted. Deleting a plan permanently deletes its goals, tasks and the focus rounds recorded against them; planned days and General focus stay until you delete your account. Everything in the goal planner is deleted if your account is deleted.

When you correspond with us

If you reply to an email or contact us another way, we may also process the information in that correspondence and any details you choose to provide.

We receive information directly from you, automatically from your device, from an authorised operator who provisions an invited account, and from the providers used to deliver and secure the platform. We do not buy personal data from data brokers.

Why we use personal data

Purpose	Legal basis
Deliver, maintain and secure the platform and its public content	Our legitimate interests in operating a reliable and secure service
Rate-limit requests, verify submissions, authenticate users and prevent abuse	Our legitimate interests in protecting the platform, its users and its providers
Deliver and respond to contact messages	Our legitimate interests in communicating with you, or taking steps you ask us to take before a possible arrangement
Record and administer newsletter requests and send the DeftMove newsletter you asked for	Your consent
Send member emails you opted in to	Your consent
Send member emails to paid members who have not turned them off	Performance of our agreement with you
Provide courses, the CV builder, goal planner and focus timer you choose to use, including your own progress and planner stats	Performance of an agreement with you or steps at your request
Show the comments you post, and moderate comments, reports and bans	Performance of our agreement with you (the Terms), and our legitimate interests in keeping discussions safe and lawful
Show reactions and course ratings as totals, and keep your own	Performance of our agreement with you (the Terms)
Invite users, maintain accounts, recover access and provide granted premium access	Performance of an agreement with you or steps at your request, and our legitimate interests in administering invited access, as applicable
Take payment for a membership, provide premium access from paid periods, and let you manage or cancel billing	Performance of our agreement with you
Keep billing and payment records for the period the law requires	Compliance with a legal obligation (accounting and tax records)
Detect and prevent payment fraud	Our legitimate interests and Stripe’s, in preventing fraud; Stripe also acts on its own legal obligations
Count visits to our public reading pages (Cloudflare Web Analytics) to understand which content is read and where visitors come from	Our legitimate interests in understanding and improving the platform with aggregate statistics
Keep account activity records to secure accounts, detect and prevent fraud and abuse, account for staff actions and show when consent was given or withdrawn	Our legitimate interests in protecting accounts and the platform, preventing fraud, overseeing our staff and demonstrating your choices
Record consent, access grants and withdrawals, and honour rights or objections	Compliance with applicable legal obligations and our legitimate interests in demonstrating and respecting choices and administering the service
Establish, exercise or defend legal claims and meet legal requirements	Compliance with a legal obligation or our legitimate interests, as applicable

Where we rely on legitimate interests, we consider the effect on your rights and do not use personal data where your interests or fundamental rights override those interests.

Your choices

You do not have to provide personal data merely to read public content. The contact form’s visible fields are required because they are needed to deliver and respond to your message. The newsletter is optional.

After confirming the newsletter, you may unsubscribe from a browser that still recognises the subscription by selecting Unsubscribe and approving the explicit confirmation step. You may also withdraw a pending newsletter request or later newsletter consent at any time by emailing info@deftmove.com. Each issue also contains a personal unsubscribe link. Withdrawing consent does not affect processing that was lawful before the withdrawal.

If you receive an account invitation you did not expect, you may ignore it and contact us to request that we investigate or remove the related account information. You may also contact us about correcting or suspending your account, subject to any information we must retain for legal, security or dispute-resolution purposes.

You can turn member emails off or on at any time under Member emails on your account page, and stop them with the link in each member email. Turning them off withdraws your consent for the future; it does not affect emails sent before.

You can cancel a membership at any time with Manage billing on your account page, or by emailing info@deftmove.com.

Closing your account

You can close your account yourself: open Close account on your account’s Security page and confirm with your password. You can also email info@deftmove.com and ask us to close it. We may also close an account, for example to enforce the Terms. Closing an account:

• cancels a paid membership with Stripe straight away, without a refund for the rest of the period already paid for (see the Terms);
• ends any free Premium from a code or a grant, and member emails;
• ends your sessions: you can no longer sign in; and
• unsubscribes you from the free newsletter if you leave Also unsubscribe me from the newsletter ticked (it is ticked by default). Otherwise your newsletter subscription stays as it is, and an account we close leaves it as it is.

We send one email to the account’s address confirming the closure and the date the account will be deleted; if we closed it, the email may include a message from us. Your account and everything stored with it are deleted 30 days after it was closed, without another email. Until then, you can ask us to reopen it by replying to that email or writing to info@deftmove.com. Reopening restores access to the account only: a cancelled membership, ended free Premium and a newsletter unsubscribe stay as they are. While the account is closed, signing in with its password or signing up with its email address shows the date it will be deleted; after deletion the address can be used for a new account.

When an account is deleted, everything stored with it is deleted, except billing records we must keep (see How long information is kept): those are detached from the account, so only the Stripe references, prices, statuses and dates remain, and the email address saved with a checkout attempt is deleted. We also keep a minimal record that the account was closed: its internal identifier, whether you or which of our administrators closed it, and when it was closed and deleted. Any reason we recorded for closing or reopening it, and any message we sent you, are erased when the account is deleted.

Cookies and browser storage

We do not currently use advertising or analytics cookies. Cloudflare Web Analytics (see When you visit the platform) runs without any cookie set by us.

Cloudflare and Turnstile may use cookies or similar technologies and browser or network signals to deliver the site and protect its public forms from automated abuse. Cloudflare states that Turnstile does not access form entries or other page inputs. You can read the Cloudflare Turnstile Privacy Addendum for more information.

Newsletter recognition

After a new newsletter confirmation succeeds, the platform creates a signed browser-recognition cookie that expires after no more than 30 days. The cookie contains a pseudonymous subscriber identifier, subscription state version, and issue and expiry times; it does not contain the email address. It is marked HttpOnly, Secure and SameSite=Strict, and the browser sends it only to the newsletter-status API path and its recognised-browser unsubscribe subpath.

When the homepage checks this receipt, the application verifies its signature and expiry and then checks the current subscription status and state version in Supabase. Only the exact subscribed state that issued the receipt is recognised, and the homepage receives a masked form of the email address. The receipt is not an account or general proof of identity; it is a narrow, state-bound capability that lets that browser read the masked status and explicitly unsubscribe the recognised subscription. Successful unsubscription increments the state version, records the withdrawal time, and deletes the receipt from that browser. Selecting Use another email deletes only the receipt and does not unsubscribe the recognised address.

Account authentication

Authenticated sessions use two strictly necessary HttpOnly, Secure and SameSite=Lax cookies: a short-lived access-token cookie that follows the provider token’s expiry and a refresh-token cookie with a browser lifetime of no more than 30 days. They allow the Worker to verify and renew the session without exposing those tokens to client-side JavaScript. Logging out clears the browser cookies and asks Supabase Auth to revoke the session. Provider-side records or an access token already issued may remain valid for a limited period under the provider’s security design.

After a valid invitation or recovery link is explicitly accepted, a separate signed HttpOnly, Secure and SameSite=Strict flow cookie authorises only the password-setting step. It expires after no more than 15 minutes and is cleared after a successful reset, logout, or a permanent flow failure.

The application does not create local-storage entries for newsletter or account state. The CV builder and goal planner keep drafts and plans for visitors without an account in local storage, as described above. The focus timer keeps the current session (its timing, the task it counts towards and the article it runs on) in session storage for the open tab, and a short-lived note when the planner opens an article for a task; your chosen background sound, end-of-round alert choices and whether to be asked for an intention and reflection are kept in local storage on that device, as are whether the goal planner’s Today shows a list or a timeline, whether you last chose Plan your day or Do on each of the last 14 days, and the time your day ends in the goal planner if you set it without an account (when you sign in, it becomes your account’s end of day unless you have already set one there, and the browser copy is removed). If you turn on intentions and reflections, the lines you write and the title of the task each round was for stay in local storage on that device for 30 days (at most 100 notes) and are not sent to us. Without Premium, the reading text size you choose for articles and lessons (Default or Large) is kept in local storage on that device; with Premium it is saved to your account instead, as described above. The browser asks for permission to show notifications only if you turn them on in the planner. Provider-controlled storage and signals may still be used as described above. If optional analytics, advertising or other non-essential storage is introduced, this notice and the site’s consent controls will be updated where required.

Service providers and other recipients

Personal data is shared only where necessary for the purposes described in this notice:

Recipient	Role
Cloudflare	Hosts and delivers the platform, runs its server-side code and scheduled cleanup, rate limits requests, provides Turnstile checks for the public forms, counts visits to public reading pages (Web Analytics), and converts CV builder documents to PDF through Browser Run
Supabase	Stores newsletter, application-account, premium-entitlement, course enrolment and progress, CV builder and goal planner records (including recorded focus rounds), comments, reports and comment bans, and account activity records, and provides authentication, password recovery and session management
Stripe	Processes membership payments, hosts the checkout and billing portal pages, and keeps customer, subscription and invoice records; it also acts as an independent controller for its own fraud-prevention and legal obligations
Resend	Processes and delivers contact-form messages, newsletter-confirmation emails and newsletter issues
The configured transactional email provider	Delivers account invitations and password-recovery messages initiated through Supabase Auth
The email provider used for the DeftMove mailbox	Receives and stores contact messages and replies

The transactional email provider may also be Resend, depending on the service configuration. We may disclose information to professional advisers where reasonably necessary, or to courts, regulators and public authorities where required by law. We do not sell or rent personal data and do not share it for third-party advertising.

International processing

Cloudflare, Supabase, Stripe, Resend and other configured email providers operate internationally. Stripe may process payment information in the United States and other countries where it or its service providers operate. Depending on the service configuration and where you are located, personal data may be processed outside your country, including in countries whose data-protection laws differ from yours. The providers’ linked privacy and data-processing terms describe their transfer arrangements. Contact us if you would like information about the arrangements relevant to your data.

How long information is kept

We keep personal data only while it is reasonably needed for the purpose for which it was collected, to respect your choices, operate the service, resolve disputes, or meet a legal requirement:

Information	Retention approach
Contact messages and replies	Kept while needed to respond, manage the enquiry or an ongoing matter, and then reviewed for deletion unless a legal reason requires longer retention
Newsletter records	Pending records are deleted by a daily cleanup after the latest confirmation request has been pending for at least 30 days. Confirmed, unsubscribed and objection records may be kept while needed to administer the subscription, record consent and respect the preference
Newsletter browser-recognition receipt	Expires after no more than 30 days, is deleted earlier when you select Use another email or successfully unsubscribe, and stops producing a recognised result after the related subscription state changes
Account, identity and entitlement records	Kept while an invitation, account or access grant is active or reasonably needed to administer it, protect the platform, resolve a dispute, or meet a legal obligation; then reviewed for deletion or anonymisation. When an account is deleted, its billing records are detached from it as described below
Account closure records	The closure, any reopening, the reason recorded by an administrator and any message to you are kept with the account; when the account is deleted 30 days after closing, the reasons and message are erased and a minimal record remains (internal account identifier, who closed it, when it was closed and deleted)
Billing records (Stripe customer, subscription and invoice references and paid periods)	Kept for 6 years after the payment they record, then deleted by a daily cleanup; a subscription and customer reference are deleted once nothing paid in the last 6 years refers to them. If the account is deleted sooner, they stay for that period without being linked to the account
Checkout attempts (including the email used for checkout)	Deleted 30 days after the checkout was started, or straight away if the account is deleted
Receipts of Stripe messages	Deleted 90 days after they were received
Records kept by Stripe	Kept by Stripe under its own retention rules and legal obligations
CV builder documents	Kept with your account while it exists; you can edit any content or delete a CV at any time (except your only one), and all CVs are deleted if the account is deleted
Course enrolments and progress	Kept with your account while it exists, including after you leave a course (so enrolling again restores your progress); Reset progress deletes a course’s completed lessons, and everything is deleted if the account is deleted
Goal planner records	Plans, days, focus rounds and planner settings are kept with your account while it exists; you can change or delete plans and day entries at any time, deleting a plan deletes its focus rounds, and everything is deleted if the account is deleted
Browser-kept drafts and preferences	Visitor CV drafts and planner plans are removed 30 days after the last change; focus sessions last for the browser tab; sound, alert and reading size choices stay until you clear this site’s data
Authentication and password-flow cookies	The access cookie follows the provider token’s shorter expiry, the refresh cookie lasts no more than 30 days in the browser, and the invitation or recovery flow cookie lasts no more than 15 minutes; they may be cleared earlier as described above
Unsubscribe or objection records	The minimum information may be kept as long as needed to ensure the preference is respected and to demonstrate compliance
Visitor statistics (Cloudflare Web Analytics)	Kept by Cloudflare under its own terms; we only view totals in Cloudflare’s dashboard and keep no copy
API rate-limit data	Used for rate limiting configured over a 60-second window; any provider-level security logs are retained under Cloudflare’s settings and terms, which the application does not control
Saved items	Kept with your account until you remove them or your account is deleted
Member email choice and opt-in record	Kept with your account while it exists, including after you turn member emails off (to show when consent was given and respect your choice); deleted when the account is deleted
Reactions and course ratings	Kept with your account until you change or remove them or your account is deleted; totals contain nothing that identifies you
Comments	Kept while your account exists and you have not deleted them. When your account is deleted, your published comments stay, shown as “Deleted member” with nothing that identifies you, so replies keep their context
Removed and deleted comments	Kept hidden, for disputes and reports, for 12 months after they were removed or deleted, then erased
Account activity records	Kept for 24 months after the event, then deleted by a daily cleanup, including the records of an account that has since been deleted (they hold its internal identifier, never its email address)
Reports and bans	Reports are kept with the comment (without the reporter once the reporter’s account is deleted); bans are kept with the account and deleted with it
Provider logs, backups and delivery records	Retained according to the relevant provider’s settings, contractual terms and legal obligations

Information may be kept longer where reasonably necessary to investigate abuse, resolve a dispute, establish or defend a legal claim, or comply with law. It will be deleted or anonymised when there is no longer a reason to retain it.

Your data-protection rights

Depending on the circumstances and the law that applies to you, you may have the right to:

• access and receive a copy of your personal data;
• correct inaccurate or incomplete information;
• request deletion or restriction of processing;
• object to processing based on legitimate interests;
• object at any time to the use of your data for direct marketing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

To exercise a right, email info@deftmove.com. We may need to confirm your identity before completing a request. Some rights are subject to legal conditions and exceptions.

You may also complain to the data-protection authority where you live or work, or where you believe a breach occurred. If the Irish Data Protection Commission is the relevant authority for you, its details are available at dataprotection.ie.

Automated security and access checks

Rate limiting and Turnstile automatically assess relevant submissions and may reject or delay a request that appears abusive or automated. Signup and login also require a Turnstile check. Newsletter confirmations, recognised-browser unsubscribe actions, password recovery and other authentication requests use rate limiting without an additional Turnstile check.

Requests for protected content also trigger an automatic check of the current session, account status, entitlement status and any entitlement expiry, of whether a paid membership period covers the current time and, for a course lesson, of whether you are enrolled in the course. This check only determines whether the requested account, premium or lesson page is available. Contact us if you believe access was denied incorrectly.

These checks protect the platform and do not make decisions that have legal or similarly significant effects on you. We do not use personal data collected through the platform for behavioural profiling.

Security

We use reasonable technical and organisational safeguards, including access controls, restricted database permissions, server-side secrets, protected cookies, rate limiting and bot checks. No internet transmission or storage system can be guaranteed to be completely secure.

External links

The platform links to websites and services operated by others. Following an external link takes you to a service whose privacy practices are governed by its own notice, not this one.

Changes to this notice

We may update this notice when the platform’s features, providers or legal obligations change. The date at the top shows when it was last updated.

Contact

Questions, requests or concerns about this notice or the use of personal data can be sent to info@deftmove.com.