VLTRON is joining ClickHouse to power the open-source Agentic Data Stack 🎉 Learn more

Legal

Privacy Policy

Last updated: September 12, 2026

1. Overview

This Privacy Policy describes how the VLTRON documentation website (vltron.com, the “Site”) handles information about its visitors. We use privacy-preserving, cookieless tools for aggregate analytics and performance monitoring. With your express consent, we may also load Reo.dev performance analytics, which uses first-party cookies to understand how developers use the website and documentation. We do not use advertising cookies or track your activity across unrelated websites.

This policy applies to the documentation website only. It does not apply to the VLTRON application itself, which you self-host and operate.

2. Who We Are

For the purposes of data protection law (including the EU/UK General Data Protection Regulation, the California Consumer Privacy Act, and applicable laws of the Republic of Uganda), the data controller is Cashtopia LLC. You can reach us at [email protected] or via the project repository on GitHub.

3. Information We Collect Automatically

When you visit the Site, our analytics and performance-monitoring tools may collect a limited set of technical signals. The specific collection depends on your optional analytics consent.

3.1 Aggregate Usage Analytics — Plausible Analytics

We operate a self-hosted instance of Plausible Analytics. Plausible is a privacy-focused alternative to traditional web analytics. Specifically, Plausible:

  • Does not set cookies and does not use localStorage or any other persistent client-side identifier.
  • Does not retain or log IP addresses. IP addresses are processed transiently in memory only to derive an approximate country and to compute a one-way, daily-rotating hash used for visitor de-duplication; the IP itself is then discarded and never written to any database.
  • Does not create persistent profiles, does not track users across websites, and does not share data with advertising networks or data brokers.

The data points collected are limited to:

  • The URL of the page you visit and the URL of the page that referred you (the HTTP Referer header).
  • Coarse browser, operating-system, device-type, and screen-size information derived from the User-Agent header.
  • An approximate country derived from your IP address at request time.
  • Clicks on outbound links (links pointing to domains other than vltron.com) and a small number of named events such as card_click and link_click that record interactions with navigation cards and document links.

Because all of these signals are stored in aggregate without persistent identifiers, we cannot use them to identify you, contact you, or correlate your visits to this Site with your activity on any other site.

3.2 Performance Monitoring — Core Web Vitals

When enabled by the Site operators, we collect anonymous Core Web Vitals measurements using the open-source web-vitals library and a small VLTRON client-side collector that forwards them to a self-hosted ingestion endpoint. These measurements help us detect and fix performance regressions. Specifically:

  • The metrics collected are the standard Web Vitals: Largest Contentful Paint (LCP), Interaction to Next Paint (INP), Cumulative Layout Shift (CLS), First Contentful Paint (FCP), and Time to First Byte (TTFB).
  • Each measurement is associated with a route template and the concrete URL path you are viewing.
  • A session identifier is generated in browser memory using crypto.randomUUID(), is rotated on every page navigation, and is never persisted to cookies, localStorage, sessionStorage, or any other browser storage.
  • Measurements may be sampled to reduce processing volume; named events are not sampled.

3.3 Developer-Intent Analytics — Reo.dev (optional)

If you accept performance analytics, the Site loads Reo.dev JavaScript from static.reo.dev. Reo.dev receives page views and technical-content interactions, together with technical signals such as your browser information, IP address, referring URL, and Reo.dev identifiers. Reo.dev uses these signals to associate activity across visits, analyze developer interest, and provide VLTRON with company and developer-intent insights.

Reo.dev sets first-party identifiers with a maximum documented lifetime of 300 days. The script does not load unless you consent, and rejecting optional analytics does not affect the Site. You can withdraw consent at any time using the Cookie preferences button.

3.4 Server Logs

Like virtually all web servers, the infrastructure that serves this Site generates short-lived operational logs that may include the requesting IP address, the requested URL, the HTTP status code, and the User-Agent string. These logs are retained only as long as is necessary for security, fraud prevention, and reliability investigations (typically days, not months) and are not used to build user profiles.

4. Information We Do Not Collect

The Site does not directly request or store:

  • Account credentials (the Site has no user accounts and no login).
  • Payment information.
  • Precise GPS location or biometric data.
  • The contents of any conversation, message, file, or document.
  • Information about the contents of your activity on unrelated websites.

5. Why We Process This Information — Lawful Basis

Where the EU/UK GDPR applies, we rely on the following lawful bases under Article 6(1):

  • Legitimate interests (Article 6(1)(f)) for the cookieless analytics, performance measurements, and short-lived operational logs described above.
  • Consent (Article 6(1)(a)) for Reo.dev performance analytics and its first-party identifiers. You may decline or withdraw that consent without affecting access to the Site.

6. How Long We Keep Information

  • Aggregate analytics (Plausible): retained indefinitely as non-identifying counts, time series, and aggregations.
  • Performance metrics (CWV): retained for as long as is useful for detecting performance regressions, typically no more than 13 months.
  • Reo.dev analytics: Reo.dev identifiers may remain on your device for up to 300 days unless you withdraw consent or clear Site data.
  • Operational server logs: retained for the minimum period required for security and reliability operations.

7. International Data Transfers

Our self-hosted analytics ingestion endpoints are controlled by Cashtopia LLC. Reo.dev states that user information is stored on servers in the United States. Where applicable, international transfers must be supported by legally recognized safeguards and the rights described below remain available.

8. Sub-Processors and Third Parties

The Site relies on the following service providers to operate:

  • Hosting and content delivery for serving the documentation pages.
  • Self-hosted Plausible Analytics, operated by Cashtopia LLC.
  • Self-hosted Core Web Vitals ingestion, operated by Cashtopia LLC, when performance monitoring is enabled.
  • Reo.dev for consent-based website and documentation analytics, when enabled.

We do not sell personal information or use Reo.dev for cross-context behavioral advertising.

9. Your Rights

Subject to applicable law, you may have the following rights with respect to information about you:

  • The right to access personal data we hold about you, to rectify inaccuracies, to request erasure, to restrict or object to processing, and to data portability (EU/UK GDPR).
  • The right to know what personal information has been collected, the right to delete personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination (California CCPA/CPRA).
  • Rights under the Uganda Data Protection and Privacy Act, 2019, including the right to access, correct, and delete personal data, and the right to object to processing.
  • The right to withdraw consent at any time where processing relies on consent.
  • The right to lodge a complaint with your local data-protection supervisory authority.

If you would like to exercise your rights, contact us at [email protected] with enough detail for us to investigate.

10. Browser Controls and Opt-Out

You can limit analytics collection at any time by:

  • Enabling Do Not Track or Global Privacy Control in your browser. On a first visit, either signal is treated as a rejection of optional Reo.dev analytics.
  • Opening Cookie preferences to reject or withdraw consent for Reo.dev.
  • Using a content blocker, browser rule, or privacy-focused extension to block requests to the analytics paths or Reo.dev endpoints.
  • Disabling JavaScript for this Site, in which case no analytics will be sent.

11. Local Browser Storage

The Site stores small amounts of information in your browser for usability purposes, including theme and navigation preferences, an explicit language choice, and your optional-analytics consent choice. Preference values stay on your device and can be cleared through your browser's site-data controls. See the Cookie Policy for names and durations.

12. Children's Privacy

The Site is intended for software developers, IT administrators, and other professional users and is not directed at children under 16. We do not knowingly collect information from children. If you believe a child has provided personal information to us, please contact us and we will take appropriate action.

13. Security

We apply industry-standard administrative, technical, and physical safeguards to the limited data we process. The Site is served over HTTPS, uses security headers including a Content Security Policy, and is supported by automated dependency monitoring. No internet transmission or electronic storage is perfectly secure, but we work to reduce risk in line with reasonable industry practice.

14. External Links

The Site contains links to third-party resources, including the VLTRON GitHub repository, package registries, third-party documentation, community forums, and the websites of integration partners. We are not responsible for the privacy practices of those third parties; please review their privacy notices when you visit them.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in technology, applicable law, or our operational practices. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, draw additional attention to the change. Your continued use of the Site following any update constitutes acceptance of the revised policy.

16. Contact

For questions or requests related to this Privacy Policy, including requests to exercise your rights, please contact us at [email protected] or open an issue in the project repository.

By using this documentation site, you acknowledge that you have read and understood this Privacy Policy. The technical implementation of every analytics signal described above is publicly visible in the Site's source code.