Updated

Privacy Policy

What this site collects, why, who sees it, and how to have it corrected or deleted.

In short

  • We collect what you choose to send us: a message from the contact form, a job application, an email or a call.
  • Our pages load services of other companies: Google Analytics, which counts visits; Microsoft Clarity, which shows us how our pages are used; Sentry, which tells us when a page breaks; Cloudflare, which carries the site's traffic and checks our forms against spam; Apple Music, whose player our pages make ready once you start using them and which plays our music when you turn it on; and, while we run ads, Google Ads and Meta, which tell us which of our ads bring clients. A call you book on our site goes into our Google Calendar.
  • Our own few cookies remember your sound settings, how much 3D your device draws smoothly and your answer to the cookie note. Your reading settings and a few others stay in your browser, on your device only. If your device is set to a US time zone, the cookies of Google, Microsoft and Meta that count visits and measure our ads are on from your first page, as that note says, until you turn them off; everywhere else, and when your browser sends a Global Privacy Control signal, they come only with your yes. The cookies Microsoft and Meta keep on their own domains are listed below, under Cookies and browser storage.
  • We do not sell your personal information for money. While our ads run, our pages and our server tell Google and Meta which visits and messages our ads brought; "No" in the cookie note, footer - Cookies, or your browser's Global Privacy Control signal stops it.
  • To see, correct or delete what we hold about you, write to talk@26loc.com.

Who we are

26 Lines of Code LLC ("26 Lines of Code", "we", "us") is a software development company headquartered in Miami, Florida, with teams in Estonia and Ukraine. This policy covers 26loc.com and what you send us through it. We decide how this data is used: in the terms of European law, we are its controller.

What we collect and why

When you write to us

Our request form asks for your name and email and, if you like, your phone number, what you need, anything that helps us prepare for the call - your words, links and files - and whether you want to sign an NDA first. If you chose what you are building on the pricing page, your choices go with your request. The files - up to five - are kept on our own server, where only our staff can open them, and come to us with the request's email. While you type your email, our server checks that its domain can receive mail - it asks the public DNS, through Cloudflare, about the domain only, never the address - and tells you of a likely typo. We use all this to answer you, discuss the project and prepare an estimate or a proposal. Emails, calls and messages you send us directly are used the same way, and so is a contact you leave on the card of one of our team: your name, an email or a phone, your company and a note go to that person by email and Telegram and into our customer records. A request also goes into our own customer records (CRM), with the tags of the link you came by - the campaign, a partner's code, the site you came from and the page you came in on - so we know what brought you.

When you apply for a job

The application form asks for your name and email, a Telegram, WhatsApp or phone contact, where you are based, a LinkedIn or portfolio link, your CV, the pay you expect, when you can start and a message. We use them to consider you for the role and, since the form asks you to agree to it, for other roles that may suit you.

When you book a call

Once your request is sent, you can pick a time for a call with us; a booking made without a request asks for your name and email and what you would like to discuss. Either way you can add a comment and up to five guests' emails. We put the call into our Google Calendar with a Google Meet link, and Google sends you and your guests the invitation; the event, kept in our Google account, carries what you wrote, your estimate, your links and the names of your files. We use your details to hold the call and prepare for it, and they go into our customer records with your request. The time zone you choose on the page is remembered on your device.

When you run diagnostics

If the site runs slowly for you, we may send you a link ending in ?diag. It opens a Diagnostics panel that records frame times, your device type, graphics card, screen size, browser version and the pages you open, and sends them to us when you press Send report, close the panel or leave the page. A report holds no name or contact details. We use reports to make the site run smoothly on devices like yours.

What any visit leaves

Like any web server, ours keeps technical logs of requests: the time, the page requested and the browser, which may include the IP address. When you send a form, we keep a note of your IP address for up to an hour to limit how many messages one address can send; it is not stored with your message. To keep our forms free of spam - the request, the job application, a contact left on a card and a call booked on a team member's own page - we may run Cloudflare Turnstile in them: Cloudflare, Inc. checks signals from your browser that tell a person from a bot, under its own privacy policy. We use logs to fix errors and fend off attacks.

Visit counting, recordings, our ads and error reports

Our pages load Google Analytics, a service of Google, through its Google tag, to count visits and see where visitors come from, including from our ads. If your device is set to a US time zone, it runs from your first page, sets its cookies and tells your visits apart, unless you turn it off: "No" in the cookie note, its Statistics switch, or footer - Cookies, at any time. Everywhere else (told by your device's time zone), and when your browser sends a Global Privacy Control signal, it does not load until you say yes. Turned off, Google's tag does not load and our pages send Google nothing (Google's consent mode, in its basic form).

Our pages also load Microsoft Clarity, a service of Microsoft, to see how they are used: where visitors click, how far they scroll, where the pointer goes and which pages they open. From this Clarity makes heatmaps and recordings of visits, which we watch to make the site clearer and faster. It also notes the browser, the device and its screen, and receives your IP address, from which it tells the country. It never records what you type into a field, and our pages also hide from it what is typed into our terminal and the whole job application form. Clarity starts after your first move on a page. Unless you turn it off with the same answer in the cookie note as for Google Analytics, it sets its cookies and connects your visits; "No" stops it and deletes its cookies, and outside the US (told by your device's time zone), or with a Global Privacy Control signal from your browser, it does not start until you say yes. Advertising storage stays off. How Microsoft handles this data is described in the Microsoft Privacy Statement.

While we run ads, our pages also load Google Ads, through the same Google tag, and the pixel of Meta Platforms, Inc. (Facebook and Instagram). They tell Google and Meta that a visit came from one of their ads - by the identifier the ad puts in the link - and that it led to a message or a booked call, so we know which ads bring clients, and Google and Meta show our ads to people like our clients. When you send a form or book a call, they also get your email and, if you wrote it with its country code, your phone number, each as a one-way code (a hash) they match against their own users' - never as it is - with the time, your IP address and browser and Meta's identifiers of the click and the browser; our server sends Meta the same through its Conversions API. Google and Meta use this under their own terms and privacy policies and may combine it with what they know about you. If your device is set to a US time zone, this runs from your first page unless you turn it off: "No" in the cookie note, its Ads switch, footer - Cookies, or your browser's Global Privacy Control signal. Everywhere else it runs only after you say yes - and with Global Privacy Control, only if you switch the ads on yourself.

Once you start using a page - you move the pointer, touch the screen, turn the wheel or press a key - our pages load MusicKit, a service of Apple Inc., from Apple's servers, and make Apple's player ready with the list of our playlist's songs, so that the music starts as soon as you turn it on; on a slow connection, or when your browser asks to save data, they wait until you point at or touch the sound switch. Nothing plays, no music reaches your browser and nothing is stored in it until you turn the music on or open Lucky's jukebox; then Apple's player streams the songs of our playlist from Apple to your browser: 30-second previews, or whole songs if you sign in with an Apple Account that has an Apple Music subscription. You sign in on Apple's own page; Apple then gives your browser a token, which stays in your browser's storage so that you stay signed in, until you sign out in the jukebox. Apple receives your IP address, from the moment its player is made ready, and what is played; we receive neither your Apple Account nor what you listen to, and our analytics are never told which song played. So that the drawing on the page moves with the music, it follows a record we made of each song of our playlist in advance - when its notes and beats come and how loud it is, with no sound in it -, which your browser gets from our server. For a song we have no record of, while its preview plays, your browser streams a silent copy of the same preview from Apple's servers and analyses its sound on your device; the copy is never played aloud, recorded or sent to us or anyone else. How Apple handles this is described in the Apple Privacy Policy.

Our pages and our server also report to Sentry, a service of Functional Software, Inc., when something breaks or runs slowly: the page, the browser and its version, what failed and the request it failed on, which includes the IP address and, for a form, what was sent in it. Sentry sets no cookies. We use these reports to fix errors.

All traffic to the site passes through Cloudflare, which delivers the pages, keeps copies of them close to visitors and shields the site from attacks.

Legal bases in the EU and the UK

Answering your message, your booking and your application are steps you ask us to take before a possible contract; answering business inquiries is also our legitimate interest. Keeping an application for other roles rests on your consent, which you can withdraw at any time. Diagnostics, logs, the limit on messages and the forms' check against spam rest on our legitimate interest in a fast and secure site. Counting visits, recording how our pages are used and measuring our ads with Google and Meta rest on your consent; error reports rest on our legitimate interest in a site that works. Making Apple's player ready before you turn the music on rests on our legitimate interest in music that starts without a wait.

Cookies and browser storage

Our own cookies are small. None of them identifies you or follows you to other sites:

  • volume and mute: your sound settings, kept for a year.
  • music: set only when you turn the music off, kept for a year.
  • music_left: whether you left our music playing, so that it comes back by itself on your next visit, kept for a year.
  • pace: how much of the 3D picture your device draws smoothly, so your next visit starts there; kept for 60 days.
  • consent: your answer to the cookie note, kept for a year.

Unless you turn them off (outside the US, or with Global Privacy Control: once you say yes), Google Analytics adds two cookies of its own: _ga and one named _ga_ followed by our account's code. They tell one visit of yours from the next by a random number and are kept for up to two years; "No" deletes them.

On the same terms Microsoft Clarity adds _clck, which tells your visits apart by a random number and is kept for up to a year, and _clsk, which joins the pages of one visit and is kept for a day; "No" deletes them too. When Clarity runs, Microsoft also sets cookies of its own on its domains, clarity.ms and bing.com: CLID, MUID, MR, SM, SRM_B and ANONCHK. They tell a browser apart across the sites that use Microsoft's services; Microsoft says it uses them for analytics, advertising and running its services, keeps them for up to 13 months and handles them under the Microsoft Privacy Statement. Our pages cannot delete them: "No" stops our pages from reaching Microsoft, and your browser can delete or block them (Safari blocks such cookies by default).

On the same terms, while our ads run, Google Ads adds _gcl_au, which tells one visit from another for our ads, and _gcl_aw or _gcl_gb when you came from one of its ads, which keep that click; Meta's pixel adds _fbp, which tells your browser apart, and _fbc when you came from one of its ads, which keeps that click. They are kept for up to 90 days; "No" deletes them. Meta also keeps cookies of its own on its domains, such as facebook.com, if you use its services; our pages cannot delete them, and "No" stops our pages from reaching Meta.

A few values live in your browser's session storage and disappear when you close the tab: an estimate or the first words of a message on their way to the contact form, whether diagnostics are on, the order Lucky shuffled his playlist in for the visit and whether he has shown you his hint in it, and the tags of the link you came by - the campaign, a partner's code, the site you came from, the page you came in on and, while the ads are allowed, the identifier of an ad's click - which go with a form you send. Our staff get a sign-in cookie and a security token when they open our admin; visitors do not.

A few of your own settings stay in your browser's local storage, on your device only, and are never sent to us: the size, typeface, spacing and colours you choose for reading our articles, whether the reading mode opens by itself and whether you have used it (so its hint is not shown again), and for the visit that the hint was shown; the graphics you set in the footer and whether your device draws our 3D smoothly; the time zone you choose on the booking page; where you moved the contact button; whether Lucky's music has played for you before (so it starts with the same two songs only once) and whether you have opened his jukebox or closed his hint about it (so the hint is not shown again); and, for half a minute, the words of an order on their way to a contact form you opened in another tab. Clearing this site's data in your browser removes them.

The cookie note tells you that we count and record visits and measure our ads, and stays until you answer: "Yes" turns them on, "No" keeps the cookies of Google, Microsoft and Meta off from then on and deletes those already set, and its details let you switch statistics and ads on or off one by one, then Save. If your device is set to a US time zone they are on until you answer. Everywhere else (told by your device's time zone), and when your browser sends a Global Privacy Control signal, the note asks first instead: nothing is counted, recorded or sent for our ads until you say yes, and with Global Privacy Control "Yes" turns on the statistics only - the ads only by their own switch. You can change your answer at any time: footer - Cookies.

Who sees your data

  • Our team: the people who answer inquiries, prepare estimates and hire. They work in the US, Estonia and Ukraine.
  • Companies that run parts of our work for us: Hetzner, which hosts our servers in Helsinki, Finland; Resend, which emails the forms' notifications to our team, and Telegram, which sends them to our team's chats (a CV goes by email only); Cloudflare, which carries the site's traffic and checks our forms against spam; Google, whose Analytics counts visits and whose Calendar and Meet hold the calls you book; Microsoft, whose Clarity shows us how our pages are used; Functional Software, whose Sentry receives our error reports. They handle data on our behalf.
  • Google and Meta, for our ads: while our ads run, what our pages and server send them about the visits and messages our ads bring (see Visit counting, recordings, our ads and error reports). They use it as their own terms say, not only on our behalf.
  • Authorities, when the law requires it, and our lawyers and accountants, when needed to protect our rights.
  • A buyer or successor, if our business is merged or sold; this policy would still apply to your data.

We do not sell personal information for money. While our ads run, what our pages and server send Google and Meta about visits and messages may count, under California law and similar US state laws, as selling or sharing personal information for cross-context behavioral advertising. You can opt out at any time: "No" in the cookie note, or the Ads switch in footer - Cookies; we also take your browser's Global Privacy Control signal as an opt-out.

Where it is stored

The site and its database run on servers in Helsinki, Finland; Cloudflare's network carries the traffic; visit counts are kept by Google and error reports by Sentry, in the US, and recordings of visits by Microsoft in its Azure cloud; what our ads send Google and Meta is processed by them, in the US and elsewhere. A form's notification goes from our notification service, on the same servers in Helsinki, through Resend in the US and through Telegram to our team. Our team works from the US, Estonia and Ukraine, so the person who answers you may read your message in any of these countries. If you write to us from the EU or the UK, your data travels to the US and Ukraine because answering your request requires it.

How long we keep it

  • Messages: as long as they serve our conversation with you. If you become a client, records of our work together stay as long as the contract and tax and accounting law require.
  • Job applications: while the role is open and, if you agreed, while we may offer you another role.
  • Diagnostics reports: while they help us make the site faster.
  • Server logs: only as long as we need them to fix errors and keep the site secure.
  • Visit counts: as long as our Google Analytics account keeps them, 14 months at most.
  • Recordings of visits: 30 days in Clarity; those we mark as favorites, and a random sample Clarity keeps, up to 9 months.
  • Error reports: up to 90 days in Sentry.
  • What we send Google and Meta for our ads: as long as their accounts keep it; our own copy of what went to Meta loses who you are 30 days after it went.
  • The forms' notifications: up to 30 days in our notification service; the emails and messages our team received are kept like messages.
  • Cookies: for the periods listed above; you can delete them in your browser at any time.

Ask us to delete your data sooner, and we will, unless the law requires us to keep it.

Your rights

Wherever you live, you can ask us to:

  • tell you what personal data we hold about you and send you a copy;
  • correct it;
  • delete it;
  • stop contacting you;
  • withdraw a consent you gave, such as keeping your application for other roles.

Write to talk@26loc.com from the address you used with us, or tell us how we can confirm it is you. We answer within 30 days and charge nothing. Using these rights does not change how we treat you.

In the EU, the UK and countries with similar laws, you can also restrict or object to our use of your data, receive it in a portable format, and complain to your data protection authority. Residents of California and other US states with privacy laws have the rights those laws give, including to know, correct and delete, and may act through an authorized agent.

Security

Pages and forms travel over HTTPS. CVs and the files you share with a request are kept outside the folders the site serves: they have no public link and open only in our admin, which only our staff can sign in to. No way of sending or storing data is perfectly safe; if a breach affects your data, we will tell you as the law requires.

Children

The site is meant for businesses and job seekers. We do not knowingly collect personal data from anyone under 16. If a child has sent us something, write to us and we will delete it.

Other sites

Links to Clutch and other sites lead to services with their own privacy policies. This policy does not cover them.

Changes

When we change this policy, we update this page and its date. If a change affects data you have already given us, we will say so at the top of the page.

Contact