Privacy Policy

Effective Date: October 10, 2026
Last Updated: October 10, 2026

Welcome to DenverNerd (denvernerd.com). Your privacy and digital autonomy are paramount to us. This Privacy Policy details how we collect, process, store, and safeguard your personal information when you access our technical field notes, participate in community discussions, purchase digital CAD/STL models, or subscribe to our newsletter.

1. Information We Collect

A. Information You Directly Provide

Digital Storefront Purchases: When you purchase digital STL blueprints, toolhead mounts, or firmware bundles, we collect your email address to issue cryptographically signed fulfillment download tokens and generate order invoices. Payment details (credit card number, CVC, expiration) are collected directly by our payment processor (Stripe) and are never transmitted to or stored on our servers.
Newsletter & Mailing List: If you subscribe to DenverNerd Field Notes, we collect your email address and track verification status via a cryptographic double opt-in mechanism (Pending, Confirmed, Unsubscribed).
Account Registration & Community Comments: When creating an account or posting technical comments, we store your username, email address, salted PBKDF2 password hash, and the Markdown content of your comments.

B. Automatically Collected Telemetry & Diagnostics

Server Logs & Observability: For security defense, diagnostic probing, and rate limiting, our edge proxies (Caddy) and core engine record standard HTTP access logs including client IP address, request URI, HTTP status code, user agent, and distributed correlation IDs (X-Correlation-ID).
Affiliate Link Telemetry: When clicking outbound links routed through /go/{slug}, non-blocking atomic Redis counters are incremented without associating clicks with your personal identity or IP address.

DenverNerd adheres to a zero-tracking, essential-first philosophy:

Session Authentication Cookies (denvernerd_session): A cryptographically signed HMAC-SHA256 cookie required exclusively to maintain authenticated state for registered users and operators.
Consent Persistence (denvernerd_cookie_consent): Stored in your browser's localStorage to remember that you acknowledged our essential cookie banner.
No Third-Party Ad Trackers: We do not deploy third-party advertising networks, cross-site trackers, or behavioral profiling scripts.

3. Third-Party Service Providers

We partner only with vetted infrastructure and fulfillment providers:

Stripe Payments: Handles checkout payment processing securely. Stripe processes card details under Level 1 PCI-DSS compliance. View Stripe's Privacy Policy.
Self-Hosted Infrastructure: Our core APIs, PostgreSQL relational store, Redis cache, and Docker mail servers operate on isolated bare-metal and hardened cloud VPS instances with encrypted WireGuard mesh networking.

4. Data Retention & Security

Order Records: Immutable order records and purchase transaction histories are retained for tax, accounting, and license validation purposes.
Cryptographic Protections: All digital fulfillment tokens, password hashes, and session cookies utilize constant-time cryptographic primitives (HMAC-SHA256, PBKDF2-SHA256 with 100,000 iterations, and FixedTimeEquals).
Data Retention Schedule: Unconfirmed newsletter subscriptions older than 30 days are automatically purged. Session tokens expire after 24 hours of inactivity.

Depending on your jurisdiction, you possess the following rights regarding your personal data:

Right to Access & Portability: You can download a complete, structured JSON export of all personal data, orders, and subscriptions stored in our systems at /account/privacy or via GET /api/account/export-data.
Right to Rectification: Update your account email, display name, or password at any time via /account/security.
Right to Erasure ("Right to be Forgotten"): Request immediate account deletion and credential erasure at /account/privacy or via POST /api/account/delete. In accordance with legal obligations, financial order records are anonymized to protect customer accounting history while permanently removing your identity.
Right to Withdraw Consent: Unsubscribe from mailing lists at any time using the 1-click unsubscribe link in any email or visiting /newsletter/unsubscribe.

6. Contact Information

If you have questions, data subject requests, or privacy concerns, contact our designated data operator:

Email: privacy@denvernerd.com
Core Engine: DenverNerd Engineering & Infrastructure