Privacy Policy
Last updated: 14 September 2026 · Applies to devcut.co.in, the DevCut VS Code extension, and the DevCut backend service.
1. Who we are
DevCut is a product of Microlent Systems Pvt. Ltd., Manohar 5th Floor, CYB-6, RIICO Cyber Park, near Saras Dairy, HI Area Phase II, Jodhpur, Rajasthan 342003, India ("DevCut", "we", "us"). This policy covers:
- The marketing site at devcut.co.in (this page's domain);
- The DevCut VS Code extension (client-side code that runs in your editor);
- The DevCut backend API and web dashboard.
2. What we collect, and why
DevCut has two kinds of users: developers (who install the extension and see sponsor lines) and advertisers (who submit inquiries to run those sponsor lines). Here is what we actually store, by feature:
Waitlist / invite-code signup (homepage form)
| Field | Stored? | Purpose |
|---|---|---|
| Name | No — used only to personalize the invite email, not saved to our database | Email personalization |
| Email address | Yes | Send your invite code; account identifier once you register |
| Company / university | Yes | Understand our user base; shown to advertisers only in aggregate, never individually |
| GitHub username (optional) | Yes, if provided | Signup context only — separate from GitHub OAuth sign-in below |
| Role (developer/advertiser/both) | Yes | Route follow-up correctly |
| IP address | Yes | Abuse/fraud detection (e.g. one person claiming many invite codes) |
| Consent timestamp | Yes | Evidence you agreed to this policy and our Terms at signup |
Account (once you activate an invite code or sign in with GitHub)
| Field | Purpose |
|---|---|
| Login identifier, account communication | |
| UPI ID | Pay out your earnings — this is a financial account identifier, treated as sensitive |
| GitHub account ID (if you use GitHub sign-in) | Alternative login method; we verify your GitHub-verified email via GitHub's API — we never get write access to your repos or code |
| Experience level, primary stack, country (optional profile survey) | Better ad targeting; entirely optional |
| Session token (hashed, not the raw token) | Keep you signed in; the raw token itself is stored client-side only (browser localStorage or the VS Code extension), never on our server |
Usage / impression data (what the extension sends while you work)
| Field | Purpose |
|---|---|
| Sponsor line shown, task type (build/test/install) | Serve the right ad, compute your earnings |
| Dwell time — how long the status-bar line was visible/focused | Verify the ad was genuinely seen, so advertisers pay for real attention, not a discarded slot |
| IP address on each impression | Fraud detection (e.g. scripted/bot-like request patterns) |
| Click events (if you click a sponsor line) | Report clicks to advertisers; billing |
What the extension never sees or sends: your source code, keystrokes, editor contents, file names, Git history, or team/PR data. It only makes an HTTP call when a qualifying task starts and another when it ends.
Advertiser inquiry form
Company name, contact name, work email, website, ad copy, destination URL, budget range, product category, and any notes you add — used to evaluate and run your ad campaign, and to invoice you. A consent timestamp is recorded the same way as the developer signup form.
Withdrawals
Amount, UPI ID, and status of each payout request — needed to actually pay you and to keep an audit trail for accounting.
Exit feedback
If you sign out or delete your account, we may ask an optional one-question survey (satisfaction score + comment). Skippable.
3. Legal basis / consent
- Consent — for the waitlist and advertiser-inquiry forms, and for optional profile fields, we act on your explicit, opt-in consent captured at submission (an unticked checkbox you must actively check).
- Performance of a contract — account data, impression/dwell data, and withdrawal data are processed because they are how the developer-pays-you or advertiser-runs-ads service actually works.
- Legitimate interest — IP address and dwell-pattern data are used narrowly for fraud/abuse detection, which protects the integrity of the payout system for everyone.
You can withdraw consent for optional data (profile survey, marketing follow-up) at any time by emailing us; this does not affect data we must keep for the core service to function or for legal/accounting reasons (see Retention below).
4. Who we share data with
| Processor | What they receive | Why |
|---|---|---|
| Resend | Name, email address, email content (invite codes, notifications) | Transactional email delivery |
| GitHub (OAuth) | An access token you grant, used once to verify your identity/email | GitHub sign-in, as an alternative to invite codes |
| Razorpay X | UPI ID and payout amount | Send your earnings to your UPI account |
| Railway (hosting) | All data described above, as our infrastructure/database host | Application hosting and database storage |
We do not sell personal data, and we do not use any advertising, analytics, or tracking SDK on the site or in the extension — we checked the code specifically for this and found none. Advertisers only ever see aggregate reporting (impressions, clicks, spend) — never individual developer identities.
5. International transfers
Resend, GitHub, and Razorpay are third-party processors whose infrastructure may process or store data outside India. We have not audited each processor's current data-localization or standard-contractual-clause status as part of this review — if that matters for your situation, ask us or check each provider's own privacy/DPA documentation directly.
6. Retention and deletion
You can delete your account at any time from the extension or dashboard. This immediately:
- Anonymizes your email, UPI ID, company, and country on your account record;
- Revokes all active sign-in sessions.
Impression, click, and withdrawal rows are kept (linked to an anonymous internal ID, not your email) because they are financial/accounting records — advertiser billing and your own payout history depend on them. Advertiser inquiry data is kept for as long as reasonably needed for the business relationship and accounting, then deleted or anonymized on request where we are not legally required to keep it.
7. Your rights
- Access — ask us what data we hold about you.
- Correction — fix inaccurate data (e.g. UPI ID) yourself in the dashboard, or ask us to.
- Erasure — delete your account as described above.
- Withdraw consent — for anything based on consent (see §3).
- Grievance redressal — contact our Grievance Officer (§12) if you're unhappy with how a request was handled.
To exercise any of these, email techsupport@devcut.co.in. We'll respond within a reasonable time; we don't currently commit to a fixed SLA in this policy.
8. India's Digital Personal Data Protection Act, 2023
DevCut is operated from India and most users are expected to be India-based, so the DPDP Act, 2023 is relevant. A few important caveats, stated honestly rather than glossed over:
- The DPDP Act's substantive obligations come into force in stages, via notified Rules and commencement dates set by the government (the Digital Personal Data Protection Rules, 2025 lay out phased timelines for different obligations). We are not asserting that every provision of the Act is currently in force — check the Ministry of Electronics and IT's official notifications for the current commencement status of any specific obligation before relying on this section for a legal position.
- Regardless of exact commencement dates, we've written this policy to already reflect DPDP-style principles — purpose limitation, consent, a named grievance contact, and a deletion mechanism — because that's good practice independent of enforcement timing.
9. Security
We use hashed (not raw) session tokens, environment-variable-based secrets (never hardcoded in source), parameterized database queries, and rate limiting on public endpoints. No system is unbreakable, and we make no claim that DevCut is "100% secure" — if you find a vulnerability, please report it to techsupport@devcut.co.in before disclosing it publicly.
10. Children
DevCut is a professional developer tool, not directed at children. We don't knowingly collect data from anyone under 18, and we don't run age verification — accordingly, we don't run ad categories (gambling, adult content, speculative crypto) that would depend on one. See our advertiser policy.
11. Changes to this policy
We'll update the "Last updated" date above when this policy changes, and post material changes on our FAQ or by email where required.
12. Contact / Grievance Officer
Email: techsupport@devcut.co.in
Postal: Microlent Systems Pvt. Ltd., Manohar 5th Floor, CYB-6, RIICO Cyber Park, near Saras Dairy, HI Area Phase II, Jodhpur, Rajasthan 342003, India
This inbox also serves as our current data-protection/grievance contact point pending formal designation of a named Grievance Officer, as this policy and the underlying legal requirement mature.