Xcoden — Legal
Privacy Policy
What xcoden.com collects, what it deliberately doesn't, and how to reach us about your information.
Xcoden, LLC ("Xcoden", "we", "us") designs and builds custom e-commerce systems from Chicago, Illinois. This policy covers xcoden.com and what happens when you email us.
Work we do for clients is governed by our agreement with that client, not by this page. If you are a customer of a system we built for another company, that company's privacy policy applies to you, not ours.
The short version
- The site is static. We set no cookies, run no analytics, and load no advertising or tracking pixels.
- There are no accounts, no logins and no forms. The only thing you can send us is an email.
- We do not sell or share personal information, and never have.
What we collect
What you send us
If you write to [email protected], we receive whatever is in the message: your name and email address, the content, and any attachments. We use it to reply, to work out whether we are a fit for the project, and — if we end up working together — to run the engagement.
What the server records
Like any web server, ours writes a line to a log for each request: the IP address, the time, the URL requested, the response code and size, the referring page and the browser's user-agent string. Cloudflare, which sits in front of the site, records similar request metadata. We use those logs to keep the site up, debug problems and block abuse. They rotate automatically, are not combined with anything else, and are not used to profile visitors.
What we don't collect
No cookies set by this site. No analytics or page-view tracking. No advertising, remarketing or conversion pixels. No fingerprinting. No accounts, no passwords, and no payment details through this site.
Who else is involved
Running a website means a handful of other companies handle data on the way to us.
| Service | What it handles | Why |
|---|---|---|
| Cloudflare | Request metadata, IP addresses | DNS, TLS, caching and abuse protection in front of the site |
| Google Cloud | The server the site runs on, and its logs | Hosting, in the United States |
| Google Fonts | Your IP address and user agent | The typefaces are fetched from fonts.googleapis.com and fonts.gstatic.com when a page loads |
| Google Workspace | Messages you send us | Delivering and storing our email |
Google Fonts is worth spelling out: when your browser loads a page here it also asks Google for the font files, so Google sees that request. Nothing else on the page comes from a third party.
How we use it
- To answer your message and carry out work you ask us to do.
- To operate, secure and troubleshoot the site.
- To meet the legal, tax and accounting obligations that come with paid work.
That is the whole list. We do not build profiles, make automated decisions about you, or use what you send us to train anything.
If you are in the EEA, the UK or Switzerland
Our legal bases under the GDPR are legitimate interests (running a secure website and replying to people who contact us), performance of a contract or steps taken before entering one, and legal obligation for records we have to keep. We do not ask for cookie consent because we do not set cookies.
You have the right to get a copy of your information, correct it, have it deleted, object to or restrict how we use it, and receive it in a portable form. You can also complain to your local data protection authority. Our processing happens in the United States.
If you are in California
We collect what the CCPA calls identifiers (your email address and IP address), internet or network activity (server logs) and whatever you choose to put in a message to us. We have not sold personal information or shared it for cross-context behavioral advertising in the past twelve months, and we do not intend to. You can ask what we hold, ask for it to be corrected or deleted, and we will not treat you differently for asking.
How long we keep things
| Data | Kept for |
|---|---|
| Server and CDN logs | Days to weeks, then rotated out |
| Email that doesn't lead to work | Until it is no longer useful, and deleted sooner on request |
| Records of paid work, such as contracts and invoices | As long as tax and contract law requires |
Ask us to delete something and we will, unless we are required to keep it.
Security
The site is served over HTTPS, the server is patched and firewalled, and access is limited to the people who run it. No system is perfectly secure, but there is little here to take: this site holds no customer database, no payment data and no accounts.
Children
xcoden.com is a business-to-business site and is not directed at children. We do not knowingly collect information from anyone under 13, or under 16 in the EEA and the UK.
Do Not Track
We do not track visitors across sites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We honor both by default.
Links to other sites
Pages here link to other companies' sites. Once you follow a link, their privacy policy applies instead of this one.
Changes to this policy
If this policy changes, the date at the top of the page changes with it. For anything material, we will say what changed.
Contact
Email [email protected] with Privacy in the subject line, or write to us:
Xcoden, LLC
167 N Green St
Chicago, IL 60607
United States
Privacy requests get an answer within 30 days.