/dev/null
Sign in

Privacy policy

effective 6 November 2026

Who we are

/dev/null ("we", "us") is a social network for developers at dev-null.sh. This policy covers it and everything we offer under that name or any other, now or in the future (the "service"). Contact: enunomaduro@gmail.com.

What we collect

  • From GitHub, when you sign in: your GitHub ID, username, name, avatar, bio, company, location, website, the email address GitHub shares, whether you have a Sponsors listing, your public SSH key fingerprints, and who you follow and who follows you.
  • From GitHub, before you sign up: when a member opens the page of your GitHub username, your GitHub ID, username, name, avatar, and bio, to show that page until you sign in and make it yours, and which members follow you on GitHub, who then follow you here once you sign up. Never your location or website.
  • From GitHub, when you claim an organization's page: whether you belong to that organization, asked once with your permission to read your organizations. Nothing else about them is kept, and your claim shows on the organization's page.
  • From an organization's admins, when they add you: that you are a member or an admin of that organization, which its members see. Admins are also listed on the organization's page.
  • From Apple, when you sign in with Apple in the iOS app: your Apple account identifier, and the name and email address you choose to share, which may be Apple's private relay address.
  • From the commit script, when you run it: the public SSH keys in your SSH agent and ~/.ssh, without their comments, to find the one on your GitHub account. They are only compared in memory against the fingerprints we store, and are never stored or logged.
  • What you post and do: commits, replies, quotes, images, polls, votes, stars, follows, mutes, blocks, reports, settings, and any other content or activity in the service, messages you send us, and data derived from all of this, such as rankings and moderation signals.
  • Private messages: messages, images, and voice notes you send in Remotes, which only the people in the conversation can see. They are encrypted at rest, are not used by AI features, and are erased with your account. Voice notes are recorded with your microphone only after you start recording; recording stops and the microphone is released when you stop or discard.
  • From our apps: when you approve a device, such as the Mac app, its key's fingerprint, its name (for a Mac, the computer's name), when you approved it, and when it was last used, until you revoke it. The private key stays in your device's Keychain and never reaches us. The Mac app keeps messages and images in memory only and saves just its preferences on your Mac; its notifications never show what a message says; and it uses the microphone only while you record a voice note. Its update check asks dev-null.sh for the latest version without your account or anything about your Mac, beyond what every request carries, such as your IP address.
  • From others: what other users post, say, or report about you, such as replies, quotes, and mentions.
  • From the join link, if you ask for one: the email address you enter on your phone, used only to send you one email with a link back to the page you were reading. We keep a keyed hash of it for 30 days, so the same address doesn't get it twice, and don't keep the address once the email is sent, except, encrypted, in our error logs if it can't be sent.
  • Technical data: IP address, browser and device information, logs, and how you use the service, such as the days you used it and which of our apps you used on them.
  • From the iOS app: a key the app makes on your phone to sign its requests, which never leaves it, and the name of your phone. The app asks for your photos or camera only when you attach an image, and for your microphone only when you record a voice note.
  • Cookies and browser storage needed for the service to work, such as for sign-in, security, and preferences.

We may also process any other data you give us, that others give us about you, or that is generated when you use the service. New features may involve other data, which this policy covers once it is updated to describe it. Signing in with GitHub, or with Apple in the iOS app, is required to use the service.

Public content

Your profile and what you post are public, to anyone on the internet, including through the public API, feeds, search engines, and other sites. Anyone can copy, archive, or reuse public content, and we can't control or remove those copies. Deleted content may still appear in replies, quotes, search engines, and copies others made. Private messages are not public. Don't post anything you don't want public. You are responsible for any personal data of others that you post.

How we use it

  • To provide and operate the service (performance of our contract with you, GDPR art. 6(1)(b)).
  • To moderate content, prevent abuse, keep the service secure, enforce our terms, improve the service, and develop new features (our legitimate interests in running a safe and working service, art. 6(1)(f)).
  • To communicate with you about the service (art. 6(1)(b) and (f)).
  • To comply with the law, and to establish, exercise, or defend legal claims (art. 6(1)(c) and (f)).
  • For anything else you consent to; you can withdraw consent at any time (art. 6(1)(a)).

We may use aggregated or de-identified data for any purpose. We don't sell personal data.

Automated processing and AI

Content, including text, images, and search queries, is processed by automated systems and AI providers, including OpenAI, OpenCode, and DeepSeek, to moderate it before it is published, and to power search, rankings, and other features. These systems only decide how content appears in the service, and don't produce legal or similarly significant effects on you.

Tagging our AI bot in a public commit asks it to reply publicly. The tagged text, a limited window of public replies leading to it, and relevant public posts and knowledge-base excerpts are sent through OpenCode to DeepSeek. Search terms are processed by OpenAI. Private messages are not included in Tom's context.

Public post text is also sent through OpenCode to DeepSeek to detect its language and, when requested, to translate it. Identical text shares cached translations for up to seven days. Your browser's preferred language selects which translation to display. Private messages are not translated.

Who we share it with

  • Service providers that process data for us, such as hosting, storage, network, and AI providers, and GitHub for sign-in.
  • Moderators and others who help us run the service.
  • Third parties whose content you load, such as GitHub for avatars and the providers of embedded players once you press play, under their own privacy policies, for which we are not responsible.
  • Authorities and others, when required by law or when we believe it is necessary to protect the service, its users, us, or anyone else.
  • A buyer, successor, or other party in a merger, acquisition, financing, reorganization, or sale of assets.
  • Professional advisers, such as lawyers, accountants, and insurers.
  • Anyone you ask us to share it with, or consent to.

The service is operated from Portugal. Wherever you are, your data is processed in the European Economic Area and in the countries where our providers operate. These recipients may process data outside the European Economic Area, including in the United States, under safeguards the law accepts, such as adequacy decisions or standard contractual clauses, a copy of which you can request from us.

How long we keep it

For as long as your account exists, and afterwards for as long as needed for the purposes above, such as keeping threads intact, preventing abuse, complying with the law, and defending legal claims. Deleted content may remain in backups and logs for a period.

If a moderator put you in timeout or banned you, we keep a record of it after you delete your account: your GitHub account id, the reason, and when it happened. It stops a banned GitHub account from signing up again, and keeps a timeout from ending early by signing up again.

When you delete your account, we keep your GitHub ID until you sign in again, so that your page doesn't come back before you sign up.

Your rights

You can export your data or delete your account from settings, or delete it in the iOS app under Settings. Under the GDPR, you may also have the right to access, correct, erase, restrict, or port your data, to object to its processing, and to lodge a complaint with a data protection authority, such as Portugal's CNPD. You may object at any time to processing based on our legitimate interests. To exercise these rights, write to enunomaduro@gmail.com. We may ask you to verify your identity, and may refuse or charge for requests the law allows us to refuse, such as ones that are manifestly unfounded or excessive.

Security

We take reasonable measures to protect data, but no system is secure, and we don't guarantee the security of any data. You are responsible for keeping your GitHub account and any keys secure.

Age

The service is not for anyone under 16. We may delete any account we believe belongs to someone younger.

Changes

We may change this policy at any time. Changes take effect as soon as they are posted on this page. It's your responsibility to check this page.

Contact

/dev/null is property of Nuno Maduro, Unipessoal Lda, a company registered in Portugal, which is "we" and "us" in this policy and the controller of the personal data processed in the service. Contact: enunomaduro@gmail.com. See also our terms of service.