Privacy Policy

1. Who we are

This website is operated by Anvil Software LLC, a Colorado limited liability company based in Denver, Colorado. We are a custom software studio, and we are the party responsible for the personal information described on this page.

If you have a question about anything here, or you want us to delete what we hold about you, write to erik@anvilsoftware.io and a person will read it.

2. What this policy covers

This policy is about anvilsoftware.io — what we collect when you read the site or send us a project inquiry.

It is not about the systems we build for clients. If we have built you an application, the data inside it is yours, and how we handle it is set out in the agreement covering that project rather than here. If you are a customer of one of our clients and you have a question about your data, the business you dealt with is the right place to ask.

3. What we do not collect

It is worth being clear about this first, because it rules out most of what a privacy policy usually has to explain:

• no visitor accounts, so no usernames and no passwords

• no payment or card details — this site takes no payments

• no advertising or cross-site tracking cookies, and no ad networks

• no precise location data

• no contact lists, address books, or data bought from anyone else

• no profiles built about you, and nothing sold or rented to third parties — not now, and not as a change of heart later

4. What we do collect

Information you send us. Our contact form asks for your name and email address, and optionally your company, what you need, your budget, your timeline, a description of your project, and how you heard about us. All of it is voluntary — the form is the only place on this site where you can give us personal information, and not filling it in costs you nothing but a reply.

Notes we add ourselves. After we speak with you, we may add our own notes to your inquiry — for example what you are trying to solve, or what we quoted. These are internal, visible only to us.

Anti-spam checks. The form includes a hidden field that humans never fill in, and a timestamp showing when the page was rendered, so we can spot submissions sent faster than a person could type. The timestamp is encrypted and neither of these is stored with your inquiry.

Your IP address. We use it to rate-limit the contact form — three submissions a minute and twenty a day from one address — so a script cannot flood us. It is held briefly by that counter and is not saved alongside your inquiry.

Analytics. We use Cloudflare Web Analytics, which is cookieless: it records page views, referring site, rough device and browser type, and country-level location, in aggregate. It does not set cookies, does not follow you across other websites, and does not identify you. That is why this site has no cookie banner — there is nothing to consent to.

Server logs. Our web server records requests in the ordinary way, including IP address, timestamp, page requested, and browser user-agent. We use them to keep the site running and to investigate abuse.

5. Cookies

This site sets only strictly necessary cookies. There are no analytics, advertising, or tracking cookies, which is why you are not asked to accept anything.

You can block or clear these in your browser settings. If you block them the contact form will stop working, because the security check cannot complete — everything else on the site will still be readable. We do not respond to Do Not Track signals, because we do not track you in the first place.

6. How we use what we collect

We use your inquiry to reply to you, to ask follow-up questions, to prepare a scope and quote, and to keep a record of our conversation if you become a client. We use analytics and server logs to understand which pages are useful, to fix problems, and to keep the site secure.

We do not use your information to train AI models. We do not send your inquiry to an AI service. AI is something we build for clients; it is not part of how this website handles your data.

We will not add you to a marketing list off the back of an inquiry. If we ever start a newsletter, you will have to ask for it.

7. Who else handles it

We keep this list short on purpose. Each of these companies processes some of your information on our behalf, under its own privacy terms:

We do not sell your information, and we do not share it with anyone for their own marketing. We may disclose it if the law requires it, or if we need to establish or defend a legal claim.

8. How long we keep it

We keep inquiries until you ask us to delete them. There is no fixed retention schedule, and we would rather say so plainly than publish one we do not actually run: a project inquiry can stay relevant for years, because people come back to a quote long after they first asked, and we would rather still have your details when you do.

You can ask us to delete your inquiry at any time, for any reason, and we will. See section 9.

Server logs are kept for a short period for security and debugging, and are overwritten in the ordinary course. Cloudflare analytics data is aggregate only and holds nothing that identifies you.

9. Your rights

Some privacy laws grant these rights only to people in particular places, and only to businesses above a certain size. We are a small studio and most of those thresholds do not reach us. We would rather not make you work out whether you qualify, so we extend the following to everyone who contacts us, wherever you are:

• ask what we hold about you, and get a copy of it

• have anything inaccurate corrected

• have it deleted

• ask us to stop using it

• object to how we are using it, and get a straight answer about why

Email erik@anvilsoftware.io and we will respond within 30 days, usually much sooner. We may ask you to confirm the email address you originally wrote from, since that is generally the only way we can match a request to a record. There is no charge, and asking will not affect how we deal with you.

10. Where your information is processed

We are based in the United States and our servers are in the United States. If you contact us from outside the US, your information is transferred here and handled under US law, which may give it different protection than your own country does. Sending us an inquiry means you understand that.

11. Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has sent us something through this site, write to erik@anvilsoftware.io and we will delete it.

12. How we protect it

The site is served over HTTPS, so what you send is encrypted in transit. Our servers and database are managed, access to them is restricted to us, and the admin area where inquiries are read sits behind a login.

Because there are no visitor accounts, there are no visitor passwords for anyone to steal — the most commonly leaked thing on the internet is simply not something we hold.

No system is perfectly secure, and we will not pretend otherwise. If information you sent us were exposed in a breach, we would tell you promptly and tell you what happened.

13. Changes to this policy

We may update this policy as the site changes. The date at the top of this page tells you when it last changed in a meaningful way, and continuing to use the site after a change means you accept the updated policy. If a change materially affects information you have already sent us, we will email you about it rather than rely on you noticing.

14. Contact us

Questions, corrections, and deletion requests all go to the same place: erik@anvilsoftware.io. We aim to reply within one business day and will always respond within 30 days.

Anvil Software LLC · Denver, Colorado, United States