Privacy Policy
Effective Date: 12 November 2026
This Privacy Policy explains what personal data we process when you use https://dappcdn.com (the "Site"), our institutional API, and our publisher dashboard, why we process it, who helps us, how long we keep it, and what your rights are. We keep the data we process to the minimum the Site needs to work, stay secure, and stay free.
In Short
- You can browse and download without an account; our access logs keep your IP address with the home and product pages you open and the files you download for 7 days, to protect the Site
- To count downloads and ratings fairly we keep one-way codes made from your IP address, not the address itself
- If you write to us, apply to publish, or request an API key, we receive what you send and some technical details to answer you and run your access
- Third-party ads (Google AdSense, BuySellAds) use cookies or personalised ads only if you agree in our consent message
- We use no analytics, tracking pixels, or remarketing, and we never sell your data
1. Who We Are
The Site is run by DAPP CDN LTD, a company registered in England and Wales (company number 16714493), with its registered office at 41 Devonshire Street, Ground Floor, London, W1G 7AJ, United Kingdom. We are the controller of the personal data described in this policy.
2. What We Process and Why
a) Visiting the Site and downloading
You don't need an account. To deliver pages and files, and to protect the Site from attacks, our providers receive the technical data every visit sends: your IP address, browser, operating system, the page you open, and the country your connection comes from.
- Access logs: each visit to the home page or a product page and each file you download is logged with your IP address, country, browser, the page or file, and the time. We use these logs only to investigate attacks, abuse, and errors. They are kept for 7 days and then deleted automatically
- Download counts: when you download a file we count it using a one-way code made from your IP address, the file, and the day. The code can't be turned back into your address and changes every day, so it can't follow you from one day to the next. We keep the totals per project, file, release, and country, not who downloaded
- Abuse protection: to stop automated downloads and spam, we keep short-lived counters made from one-way codes of your IP address. They are deleted within 48 hours
b) Ratings
When you rate a project we keep the rating with a one-way code made from your IP address and a secret key, so each visitor can rate a project once. We don't store the address itself. The code is kept for as long as the project is listed.
c) Contact form and ad reports
When you use the contact form, or report a misleading ad, we receive your name, email address, and message, with technical details that help us answer and fight spam: your IP address, browser, language, the page you came from, and the time. An ad report also includes what you reported: the page, the window size, the ad's text, and the ad's addresses. Cloudflare Turnstile checks that the form is sent by a person. The message reaches our team by email, sent through Twilio SendGrid. We use it only to answer you and to deal with the report, and we keep it for as long as that takes, at most 2 years.
d) Our own ads
Some pages show ads we sell directly ("house ads"). We count how many times they are shown as daily totals, without personal data. When you click one we record the country, browser, operating system, the page you were on, and a shortened IP address (its last part removed), to count clicks and spot fraud. Click records are deleted after 90 days.
e) Third-party ads
To keep the Site free, some pages show one ad from Google AdSense or BuySellAds (which may deliver ads through Google Ad Manager). Visitors from the UK, the European Economic Area, and Switzerland see a consent message first (Google's consent tool, which follows the IAB Transparency and Consent Framework). Advertising cookies and personalised ads are used only if you agree. If you don't, ads may still be shown, without personalisation, and the ad networks may still use your IP address to prevent fraud and estimate your location. You can change your choice at any time with "Change cookie settings" on our Cookie Policy page. Google and BuySellAds process this data under their own privacy policies.
f) Donations
You can support the Site through cryptocurrency contributions or (where enabled) PayPal:
- Cryptocurrency contributions: when you send a contribution to one of our published wallet addresses (such as BTC, ETH, USDC, LTC, DOGE, SOL, USDT, ADA, BNB, or LINK), the transaction is recorded on the public blockchain, which we do not control. We only keep records of received amounts and transaction IDs as long as the law requires for our company accounts.
- PayPal (when used): PayPal processes your payment details on its own site; we receive only what PayPal shares with us about the contribution (such as your name, email address, and the amount), and keep it as long as the law requires for our accounts.
g) Publisher accounts and institutions
If you apply to publish or manage projects in our publisher dashboard, we process your name, email address, role, links to your software, the projects you can manage, the sign-in codes we email you (stored only as one-way codes), your passkeys (public keys only) and backup codes (stored only as one-way codes), and your sessions. For security, every sign-in is recorded and emailed to our team with the IP address, browser, and request headers (never passwords or cookies), and the actions taken in the dashboard are recorded with the IP address. This data is kept while the account exists; the activity log is deleted after 90 days.
Institutions requesting or using our download API give us the institution's name, a contact person's name and email address, the intended use and apps needed, and (if chosen) the IP addresses, network ranges or countries the key is limited to. We keep their API keys, usage totals (requests, downloads, and why a request was refused), and security logs while access is active. Detailed request logs are deleted within 90 days.
3. Our Legal Bases
- Legitimate interests: running and securing the Site, counting downloads and ratings, answering messages, showing non-personalised ads, and preventing fraud
- Consent: advertising cookies and personalised ads. You can withdraw it at any time
- Contract: publisher accounts and institution access
- Legal obligation: accounting records of contributions
4. Who Helps Us
These providers process personal data for us, only to provide their service:
- Cloudflare: content delivery, security, hosting of the Site, file storage, and the Turnstile check (worldwide network)
- Server hosting provider: the servers that run our database and the publisher dashboard (European Union)
- CacheFly: delivery of downloaded files (worldwide network)
- Twilio SendGrid: sending our emails (United States)
- Google and BuySellAds: ads and the consent message (they also act as controllers under their own policies)
- PayPal: payment processing where used (as a controller under its own policy)
We check files with services such as Jotti's malware scan and VirusTotal; only the files are sent, never data about you. We don't sell, rent, or trade personal data.
5. International Transfers
Some providers process data outside the UK, including in the European Economic Area and the United States. When they do, the transfer is covered by the safeguards the law requires, such as UK adequacy regulations, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified.
6. How Long We Keep Data
- Access logs of page visits and downloads (with the IP address): 7 days
- Abuse protection counters: up to 48 hours
- Download counting codes: they change every day; only totals are kept
- Ratings: as long as the project is listed
- Contact messages, publisher applications, and ad reports: as long as needed to deal with them, at most 2 years
- House ad click records: 90 days
- Publisher dashboard activity log & API security logs: 90 days; accounts and keys: while they exist
- Accounting records for contributions: as long as required by UK tax and company law
- Database backups: up to 90 days, then deleted
- Technical logs of our providers: a few days to a few weeks
7. Your Rights
Under UK data protection law (and EEA data protection law where applicable), you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent you can withdraw it at any time. Write to us using the details below; we answer within one month. One-way codes can't be linked back to you, so we may not be able to find data stored only under them.
You can also complain to the UK Information Commissioner's Office (https://ico.org.uk/make-a-complaint/) or the data protection authority in your country, though we'd appreciate the chance to help first.
8. Data Security
- Encrypted connections (HTTPS) everywhere
- Attack and abuse protection through Cloudflare
- The publisher dashboard protected by email codes, passkeys, and a sign-in gate
- Backups kept in locked storage, deleted after 90 days
9. Children
The Site is meant for a general audience and is not directed at children under 13. We don't knowingly collect personal data from children.
10. Changes to This Policy
We update this policy when our services or the law change. The latest version is always on this page, with its Effective Date at the top.
11. Contact Us
If you have questions about this page or your data, contact us:
- Email: support@dappcdn.com
- Contact form: https://dappcdn.com/contact
- Post: DAPP CDN LTD, 41 Devonshire Street, Ground Floor, London, W1G 7AJ, United Kingdom