Privacy Policy

1. Who is responsible

DevSly (devsly.io, its API and its MCP server) is operated by WAPI Solutions LLC, which is responsible for the personal data described here. Contact: [email protected].

2. What we collect

2.1 When you visit the site

• Server logs: our hosting and Cloudflare record your IP address, the page requested, the referring page, your browser's user agent and the time.
• Tool usage records: on tool pages we store your IP address, a hashed copy of it, your user agent, your approximate country (worked out from your IP address with our own database, without sending it to anyone) and which tool you used.
• Google Analytics — only if you allow it: page views, device and browser information and approximate location, collected by Google through cookies. Nothing is sent to Google Analytics until you choose "Allow analytics" (see section 3).

2.2 If you create an account

• Email address, name, language preference, and your password as a one-way hash (we never store it in readable form).
• The IP address and time of registration and of your last sign-in, and whether your email address is verified.
• If you sign in with GitHub: your GitHub user ID, username, avatar and email address, and the access token GitHub issues for the sign-in.

2.3 API and MCP

• Your API keys and a log of API requests (endpoint, method, status, IP address and time).
• For AI assistants connected through our MCP server: the registered client name and redirect addresses, the access tokens linked to your account, and a daily usage counter.

2.4 What you send to server-side tools

Tools such as lookups, fetchers, formatters that need our server and the API tester send your input to us so we can return a result; unless listed below, that input is not stored.

• Best Skills submissions: if you submit a GitHub repository for listing, we store the repository name, the note you add, the date and the review decision, linked to your account. If we list it, the repository's public GitHub data (name, description, stars) appears on Best Skills; your note and your account do not.
• Webhook tester: every request sent to your webhook address (method, headers, query string, body up to 64 KB and the sender's IP address). We keep the latest 100 requests per webhook until you delete the webhook.
• Load testing: the target address, the settings you enter (including any authentication values you choose to provide) and the results, until you delete the report.
• Video watermark remover: the file you upload is stored only while it is processed. The result is deleted after you download it; other files are removed by an automatic clean-up that runs whenever new jobs start, usually within about 90 minutes.
• llms.txt reader: if a site you check has a valid llms.txt file, its address and score appear publicly in the "recently scored sites" list. We do not record who ran the check.
• WHOIS and domain checks: the domain names you look up are logged for troubleshooting.
• WebSocket tester: the address you test is saved in your usage history.

2.5 Security records

To protect the Service we log security events (IP address, user agent, requested address, request method, referring page and details of blocked requests), sign-in attempts (the email address entered, IP address and user agent), rate-limit counters and blocked IP addresses.

2.6 Messages and reports

If you use the tool problem-report form we store your message, the page address, your browser details and IP address. If you email us, we keep the conversation.

2.7 Security researchers

When you report a vulnerability we keep your name, email address and the report. Your name, the report summary, its severity and date are shown publicly on the Security Hall of Fame unless you ask us not to; your email address is never published.

2.8 Stored only in your browser

Some settings and inputs are saved in your browser's local storage and never sent to us: theme, favourites and recent tools, tool histories, and the text you type into many tool fields (so it is still there next time), as well as load-test settings if you choose to save them. Clear your browser's site data to remove them, especially on a shared computer.

3. Cookies

On your first visit we ask whether you allow analytics cookies. Essential and preference cookies are always used; analytics cookies are used only if you choose "Allow analytics".

• devsly_session (essential): keeps you signed in and protects forms. Expires after about an hour of inactivity.
• cookie_consent (essential): remembers your cookie choice for 6 months.
• lang, theme, recent_tools (preferences): language (30 days), light or dark theme (1 year), recently used tools (30 days).
• _ga, _ga_* (analytics, only with your consent): set by Google Analytics to count visits; they last up to 2 years.
• Cloudflare may set short-lived security cookies to filter malicious traffic.

You can change your choice at any time with Cookie settings (also in the footer). Withdrawing consent stops analytics and deletes the analytics cookies. All tools work without analytics cookies; signing in needs the session cookie.

4. Why we use your data

• To provide the Service — running the tools you use, your account, API keys and MCP connections (performance of our agreement with you).
• To keep it secure — preventing abuse, fraud and attacks, enforcing rate limits and investigating incidents (our legitimate interest).
• To understand and improve it — our own usage statistics (our legitimate interest) and, only with your consent, Google Analytics.
• To contact you — verification, password reset and security emails, and occasional announcements to registered users and security researchers. Tell us at [email protected] if you no longer want announcements.
• To meet legal obligations and to establish or defend legal claims.

5. Who we share it with

We do not sell personal data and do not use advertising networks. We share data only with providers that help run the Service, or when the law requires it:

• Cloudflare — content delivery and protection; all traffic passes through it.
• Google — Google Analytics (only with your consent) and Google Fonts.
• Script and style delivery networks (cdnjs, jsDelivr, unpkg) — your browser loads files from them directly, which shares your IP address with them.
• IP geolocation — done on our own servers with the DB-IP Lite database; neither your IP address nor the addresses you look up are sent to a geolocation provider.
• GitHub — for GitHub sign-in; avatars on Best Skills are loaded from GitHub by your browser.
• Our email server (Postal, operated by WAPI) — sends account and announcement emails.
• Domain services (Dynadot and domain registries) — receive the domain names you look up.
• z.ai (Zhipu AI, China) — only if you use the AI mode of the AI Humanizer, which sends the text you submit for rewriting. We do not store that text.
• OpenStreetMap — map tiles on the IP location tool.

6. International transfers

WAPI Solutions LLC is based in the United States, and our providers process data in the United States, the European Union and other countries, including China for the AI Humanizer's AI mode. By using these features you understand that your data may be processed outside your country, where data protection rules may differ from yours.

7. How long we keep it

• Account data: until your account is deleted.
• Webhook captures: the latest 100 per webhook, until you delete the webhook or your account.
• Best Skills submissions: until you delete your account; reviewed submissions are deleted 2 years after the decision. A listed repository stays listed, because its data is public GitHub data.
• Load-test reports: until you delete them or your account.
• Uploaded videos: deleted after download, or by the automatic clean-up that runs when new jobs start (usually within about 90 minutes).
• Rate-limit counters: about 1 hour. Proxy tool logs: 1 day.
• Password-reset links: 1 hour. Email-verification links: 24 hours. Expired sign-in tokens for connected AI assistants: deleted 30 days after they expire.
• Security, API, tool-usage and sign-in records, and web server log archives: 2 years, then deleted automatically by a daily clean-up job. Blocked network addresses are kept while the block applies, then for up to 2 years. If you delete your account, these records stay for the rest of that period without a link to your account.

8. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or KVKK in Türkiye), you may have the right to access your data, correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent. Signed-in users can export and clear their usage history from the account page.

You can delete your account yourself under Account → Security → Delete account. You confirm with your email address and current password; if you signed up with GitHub, deletion works within 10 minutes of signing in with GitHub. This removes your account together with your API keys, webhooks and their captures, load-test reports, Best Skills submissions, connected AI assistants and usage history, and we email you a confirmation. Security records that no longer name your account are kept as described in section 7.

To use your other rights, or if you cannot sign in, email [email protected] from the address on your account. We reply within 30 days. You can also complain to your local data protection authority.

9. Security

Connections use HTTPS, passwords are stored as one-way hashes, verification and reset tokens are stored hashed, and we run a public security research programme. No system is completely secure; if you believe your account has been compromised, contact us straight away.

10. Children

DevSly is a tool for developers and is not directed at children under 16. We do not knowingly collect their personal data; if you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We will post any changes here and update the date below. For significant changes we will also give notice on the site or by email to account holders.

12. Contact

• WAPI Solutions LLC
• Privacy and legal: [email protected]
• Security reports: [email protected]
• Website: DevSly home page (devsly.io)