Privacy Policy — debuginterview.dev
Last updated: 11 August 2026
1. Who we are
debuginterview.dev (the “Service”) is operated by Lkt software development and consulting Ltd, a private limited company registered in Cyprus under registration number HE442459 with registered office at Amfiktyonos, 15A, 7, 4046 Limassol, Cyprus (“debuginterview”, “we”, “our”, or “us”). We are the data controller for personal data processed through the Service.
If you have any questions about this policy or wish to exercise your rights, contact us at hello@debuginterview.dev.
2. Scope
This policy explains how we collect, use, store, and share personal data when you visit debuginterview.dev or sign up for our waitlist. It applies to all users worldwide, with specific provisions for users in the European Economic Area (EEA), the United Kingdom, and California.
The Service is pre-launch. Today the only personal data we collect from you is the email address you give us to join the waitlist. We will update this policy, and tell waitlist subscribers by email, before the product itself launches and begins processing anything more.
3. Personal data we collect
3.1 Data you provide directly
Waitlist data
- Email address
- The date and time you subscribed, and the page you subscribed from
We do not ask for your name. There are no accounts and no passwords yet.
Support correspondence — messages you send us by email.
3.2 Data collected automatically
- Server logs — our web server records the IP address, requested path, user agent, and timestamp of requests. We use these for security, rate limiting, and abuse prevention only.
- Usage and device data — see the status note in Section 7. We do not currently run any analytics or advertising technology.
3.3 Children
The Service is not directed at children under 16. We do not knowingly collect data from anyone under 16; if you believe a child under 16 has provided us with personal data, please contact us and we will delete it.
4. How we use your data and our lawful basis
| Purpose | Data used | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Managing the pre-launch waitlist and sending you the launch announcement | Email, signup timestamp | Consent (Art. 6(1)(a)) — given when you submit the form; you can withdraw it at any time |
| Responding to your support messages | Email, correspondence | Legitimate interests (Art. 6(1)(f)) — answering people who contact us |
| Security, rate limiting, fraud and abuse prevention | IP address, server logs | Legitimate interests (Art. 6(1)(f)) — protecting the Service and our users |
| Analytics and product improvement | Usage data, device data | Consent (Art. 6(1)(a)) — not yet active, see Section 7 |
| Advertising and conversion measurement | Usage data, hashed email | Consent (Art. 6(1)(a)) — not yet active, see Section 7 |
| Complying with legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, you have the right to object — see Section 9.
We do not use your data for automated decision-making that produces legal or similarly significant effects within the meaning of Article 22 GDPR.
5. Who we share your data with
We share personal data only with the following categories of recipients, who act as our processors under written data processing agreements.
| Recipient | Purpose | Location | Status |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting (VPS, deployed via Coolify) | Nuremberg, Germany (EU) | Active |
| (none — self-hosted) | Waitlist storage runs on our own Listmonk instance on the infrastructure above, so your email address is not shared with a third-party mailing-list provider | EU | Active |
| Amazon Web Services EMEA SARL (Amazon SES) | Delivering the launch announcement and any transactional mail | Ireland (EU), eu-west-1 |
Active |
| PostHog Inc. | Product analytics | EU Cloud — Frankfurt, Germany | Not yet active |
| Meta Platforms Ireland Ltd / Meta Platforms, Inc. | Advertising and conversion tracking via Meta Pixel | Ireland (EU) and United States | Not yet active |
| Google Ireland Ltd / Google LLC | Advertising and conversion tracking via Google Tag | Ireland (EU) and United States | Not yet active |
We may also disclose personal data:
- To professional advisers (lawyers, accountants, auditors) under duties of confidentiality
- To public authorities where required by law or court order
- To a buyer or successor in the event of a merger, acquisition, or asset sale, subject to standard confidentiality protections
We do not sell your personal data.
5.1 Joint controllership with Meta
This section describes an arrangement that is not yet active — see Section 7. When you interact with the Service while we run the Meta Pixel, Meta and debuginterview act as joint controllers for the collection and transmission of certain data to Meta, in line with the Fashion ID CJEU ruling. After data reaches Meta, Meta processes it as an independent controller under its own privacy policy.
6. International data transfers
Our core infrastructure (Hetzner, our self-hosted mailing list running on it, and email delivery via Amazon SES in Ireland) is located within the EU/EEA. Mail is sent from the eu-west-1 region and is not routed outside the EEA in the ordinary course.
Some of the processors listed above may transfer or access personal data outside the EEA — in particular their US parent companies, for support and administration. Where this is the case, we rely on the following safeguards under Chapter V GDPR:
- EU-US Data Privacy Framework (DPF) — where the recipient is certified, transfers are made on the basis of the European Commission’s adequacy decision for the DPF. Amazon Web Services, Meta and Google are (or have affiliates that are) DPF-certified at the time of writing; we monitor certifications and will update this policy if any cease to participate.
- Standard Contractual Clauses (SCCs) — the European Commission’s 2021 SCCs, supplemented by additional safeguards where necessary following a transfer impact assessment, for any provider that is not DPF-certified.
You can request a copy of the relevant safeguards by emailing hello@debuginterview.dev.
7. Cookies and tracking technologies
Current status as of 11 August 2026: this site sets no cookies and runs no analytics or advertising technology. No consent is requested because nothing requiring consent is loaded. The table below describes technologies we intend to introduce. We will not load any of them until a consent mechanism is in place, and we will update the status line above and notify waitlist subscribers when that changes.
| Category | Tools | Purpose | Requires consent? |
|---|---|---|---|
| Strictly necessary | Session cookies, CSRF tokens, cookie consent record | Operating the Service, security | No |
| Analytics | PostHog (EU Cloud) | Understanding how the Service is used and improving it | Yes |
| Advertising | Meta Pixel, Google Tag (including enhanced conversions) | Measuring ad performance and showing relevant ads | Yes |
Enhanced conversions involves sending a hashed (SHA-256) version of your email address to Google for the purpose of attributing conversions to ads. Although hashed, this is still personal data under GDPR, and we would only do this with your consent.
Meta Pixel captures events such as page views, button clicks, and conversion events (e.g. waitlist signup) and transmits them to Meta along with your IP address and a Meta browser identifier where present. We would only set the Pixel after you accept advertising cookies.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Waitlist email address | Until you unsubscribe, or until 24 months of inactivity, whichever comes first |
| Consent records | Records of your consent kept for 3 years after consent is withdrawn, to demonstrate compliance |
| Server logs | 30 days |
| Support correspondence | 3 years from last contact |
| Analytics data (once active) | 12 months |
9. Your rights
If you are in the EEA or the UK, you have the following rights under the GDPR / UK GDPR:
- Right of access — to obtain a copy of the personal data we hold about you
- Right to rectification — to correct inaccurate or incomplete data
- Right to erasure (“right to be forgotten”) — to have your data deleted in certain circumstances
- Right to restrict processing — to limit how we use your data in certain circumstances
- Right to data portability — to receive your data in a structured, commonly used, machine-readable format, or have it transmitted to another controller
- Right to object — to object to processing based on legitimate interests, or to direct marketing at any time
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal
- Right not to be subject to solely automated decision-making that produces legal or similarly significant effects (Article 22)
The quickest way to remove yourself from the waitlist is the unsubscribe link in any email we send you. To exercise any of the rights above, email hello@debuginterview.dev. We will respond within one month and may need to verify your identity.
You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). You may also complain to the supervisory authority in your country of residence.
10. California residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose
- Request deletion of your personal information
- Correct inaccurate personal information
- Opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising — once we introduce the Meta Pixel and Google Tag described in Section 7, our use of them for advertising may constitute “sharing” under California law, and you will be able to opt out via our cookie banner or by enabling Global Privacy Control (GPC) in your browser
- Limit the use of sensitive personal information
- Be free from discrimination for exercising these rights
To exercise these rights, contact hello@debuginterview.dev. We do not knowingly sell personal information of minors under 16.
11. Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS) and at rest, access controls, regular backups, and security monitoring. No system is perfectly secure, and we cannot guarantee absolute security.
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Cyprus supervisory authority within 72 hours and, where the risk is high, will inform affected users without undue delay.
12. Changes to this policy
We may update this policy from time to time to reflect changes in our practices, our Service, or applicable law. We will post the updated policy on this page and update the “Last updated” date. For material changes, we will notify you by email or through the Service.
13. Contact
- Email: hello@debuginterview.dev
- Post: Lkt software development and consulting Ltd, Amfiktyonos, 15A, 7, 4046 Limassol, Cyprus