What this site knows about you. Almost nothing.
This notice covers aevrix.org, including Aevrix Labs and the Trust Center. For product privacy notices, see the relevant product surface. Last updated 2026-09-13.
Edge logs only.
aevrix.org is a static website. There is no application, no database, no account system, and no cookies set by us. When you visit, our edge provider (Cloudflare) records standard HTTP request metadata: IP address, user-agent, referrer, request path, response status. We use these logs only for security and abuse monitoring; we do not build a profile of you from them.
- No analytics scripts. No Google Analytics, no Plausible, no Fathom, no first-party telemetry.
- No third-party trackers. No advertising pixels. No social-media widgets that phone home.
- No cookies set by us. The site is fully functional without cookies.
- No fonts loaded from third parties. All fonts are self-hosted from /fonts/.
Your brief stays in your browser.
The Aevrix Labs calculator and project brief run locally in your browser. Form entries are held in page memory, without cookies or local storage, and are not submitted to a server by this site. Preparing or downloading a brief does not send a message. When you choose email or WhatsApp, the prepared text is passed to the selected application, where you decide whether to send it. WhatsApp receives the text in its link when opened; its own privacy terms apply. Do not include passwords or sensitive personal data in a project brief. If you send a project enquiry, we use the contact details and message to respond and discuss the requested work. For questions or deletion requests, contact privacy@aevrix.group.
Vulnerability reports & trust enquiries.
When you write to security@aevrix.org, trust@aevrix.group, or any other Aevrix mailbox, we receive your email address, the message content, and any attachments. We hold this email in Google Workspace under our standard mailbox configuration.
- Retention: security correspondence is retained until 12 months after the issue is closed, then archived for a further 24 months for traceability, then deleted unless legal hold applies.
- Access: only the security team and our incident commander have routine access. Wider access is logged in our internal ticket system.
- Anonymous reporting: we accept reports from disposable inboxes and pseudonyms. We will only request real identity if it becomes necessary for credit, payout, or legal coordination — and only with your consent.
When and how we name you.
If you ask to be credited at /hall-of-fame/, we publish the handle or name you chose, the bug class, and the date. We never publish your email address, your IP, the PoC, or any private correspondence without your written consent.
GDPR / UK-GDPR / KVKK / Azerbaijani PD law.
Depending on where you are, you may have the right to access, rectify, port, restrict, or delete the personal data we hold about you, and to object to processing or lodge a complaint with a supervisory authority. To exercise any of these rights, write to:
Aevrix Group OJSC
Baku, Azerbaijan. Postal address available on signed DPA.
Data Processing Agreement →How we update this notice.
We update this notice in place rather than maintaining historical versions on the same URL — older versions are available in git history of the underlying static site. Material changes are dated at the top of this page.