The short version
- The site collects what you type into a form, plus the tag of the link that brought you there.
- Google Analytics counts visits for us and gets a scrambled code of any email you send in a form. It is the only outside script on the site.
- We research businesses whose websites we could fix and contact people who work there.
- We don’t sell personal information.
- To see, fix or delete what we hold, or to stop hearing from us, email sales@distrocode.com. It’s free, and we answer within 30 days.
Who is responsible for your information?
DistroCode LLC, a limited liability company registered in Wyoming, United States. The owner of DistroCode LLC is accountable for privacy.
Email is the fastest way to reach us: sales@distrocode.com, with “Privacy request” in the subject.
Our mailing address is DistroCode LLC, c/o Registered Agents Inc, 30 N Gould St Ste R, Sheridan, WY 82801, United States.
What do the forms collect?
Only what you type, plus a few hidden fields that say where you came from.
The contact form at /contact-us/ asks for your name, your email, your site address, what you need (a menu of ten options) and your message. Name, email and message are required. The site address is optional.
The free site check at /free-site-check/ asks for your site address, your email and one optional line on what’s wrong. It has no name field.
Both forms carry hidden fields named src, utm_source, utm_medium and utm_campaign. Your browser fills them from the address of the page, so they hold the tag of the link or blog post you clicked. They never hold your name or email.
Both forms also carry a signed time stamp and a hidden spam trap. Those check that a person sent the form, and hold nothing about you.
What happens when you press Send?
The site sends one email with what you typed and the link tags to our mailbox, sales@distrocode.com, and sets your email as the reply address. A person reads it and answers you.
At the same moment, our Google Analytics tag records that a form was sent and sends Google a scrambled code (a hash) of any email address, phone number or postal address in it. The section below explains how.
The site doesn’t keep your message after the email goes out. A few short-lived records in the site’s database make the form work:
- If the form shows an error, a copy of what you typed waits up to 15 minutes so the form comes back filled in. It is deleted the first time the form reads it.
- After a site check is sent, the site address and email wait up to 15 minutes so the confirmation can name them, then go the same way.
- A spam counter keeps your IP address only as a scrambled code, for 10 minutes.
- After a site check request, a scrambled code of your email and site address stops the same request being mailed twice, for 24 hours.
The site also adds 1 to a daily count of forms sent for each kind of need. That count holds no name, email or IP address.
What is collected when you just read the site?
Google Analytics, added through Google’s Site Kit plugin, records the pages you view, how you arrived, your browser and device type, and a rough location worked out from your IP address. Google says Google Analytics 4 doesn’t log or store IP addresses (Google Analytics Help, checked 17 Oct 2026).
It also records what you do on a page. That means how far you scroll, clicks on links to other sites, file downloads, video plays and searches on the site. It notes when you start filling in a form and when you send it.
Google’s tag also has a setting called user-provided data collection switched on. When you use a form, it looks for an email address, phone number or postal address. It turns each one into a scrambled code (a hash) in your browser and sends that code to Google. Google can match those codes with Google accounts to make its visit counts more accurate. It never receives the plain email, phone number or address from the tag.
When you arrive from one of our LinkedIn links, the page sends us one count with the campaign name from that link. The site keeps those counts as daily totals for 120 days. No IP address, cookie or browser storage is involved.
If the address you arrive on carries link tags, the page copies them onto its links to our contact, maintenance and site check pages. That way a form you send later still says which link brought you.
Our web host, Hostinger, keeps standard server logs, which include IP addresses, the pages requested and browser details. They are used for security and to fix faults.
The site’s LiteSpeed cache keeps ready-made copies of public pages so they load faster. It never keeps a copy of the form pages or of a page that shows what you typed.
The Yoast SEO plugin writes the page titles, descriptions and search data that search engines read. It sets no cookie and loads nothing from other sites for you.
Which other sites does a page load from?
Only Google’s, and now and then WordPress.org’s. Every page loads Google’s tag script from www.googletagmanager.com, and that script sends visit data to Google Analytics. If your browser can’t draw an emoji, WordPress fetches a picture of it from s.w.org, run by WordPress.org.
Our fonts, images and other scripts come from distrocode.com itself. There are no embedded videos, maps, chat boxes, social media buttons or advertising tags.
What about cookies?
Google Analytics is the only thing on the site that sets cookies, unless you log in to the site’s admin area. It sets first-party cookies named _ga and _ga_ followed by an ID. By Google’s default they last up to 2 years.
You can block or delete cookies in your browser, or install Google’s Analytics opt-out add-on. Every page and form still works without them.
Some browsers send a Do Not Track or Global Privacy Control signal. The site doesn’t respond to either today, so Google Analytics runs the same way when they are on. Our own site and forms don’t track you across other sites.
Do we get information about you from anywhere else?
Yes, if you work at a business whose website we think we could fix.
We read public company websites, LinkedIn company pages and public LinkedIn profiles, and we test the business’s website, for example how long its home page takes to load on a phone. We record what we find on a lead board, a database we run ourselves.
For each business the board holds the company name, website, sector and country, and its published contact address or contact form. It also holds the job titles of up to three people we’d like to reach and their public LinkedIn profile links. Then come our site measurements with the date, and a log of each contact we make and any reply. Our rule is to record a job title, not a name.
We contact people by LinkedIn connection request and message, through the business’s own contact form, and by email to a business address. Every reply comes to a person.
To stop it, reply “stop” on any channel or email sales@distrocode.com. A person marks your business as opted out and our contact with it stops. We keep that one record with the opt-out mark, because it is what keeps your business off our future lists. If you would rather we delete everything, say so, and we’ll tell you when it’s done.
What if you hire us?
We keep what any service business keeps: your contact details, our emails, quotes, invoices and payment records. We bill clients with a Stripe invoice, so Stripe handles your payment details. We never see your full card number.
To fix or look after a site, you may give us access to your site, hosting or store. Any personal information of your own customers that we see there stays yours. We touch it only to do the work you asked for, and we don’t copy it for any other use.
Why do we use your information?
- To reply to you and do the work you asked about.
- To run the free site check and send you the result.
- To find businesses whose sites we could fix, and to contact the people there.
- To send quotes and invoices, and to keep the records tax law requires.
- To see which pages and links bring people to us.
- To keep spam and abuse off the forms.
We use software agents to score businesses on the lead board and to draft and send some outreach from templates we check in advance. The score only decides whom we contact and in what order. We don’t make decisions about you by automated means that have legal or similarly significant effects.
Who else handles it?
Only the companies that run services for us, and each one handles only what its service needs:
- Hostinger hosts the website and the sales@distrocode.com mailbox, so form emails, other emails and server logs are stored on its servers.
- Google runs Google Analytics, which receives the scrambled form codes described above. It also runs Search Console, and its PageSpeed tools measure business websites for us.
- Stripe processes invoices and payments.
- LinkedIn carries our connection requests, messages and posts. What you do on LinkedIn falls under LinkedIn’s own policy.
- Anthropic provides the software agents described above, so what they read and write passes through its servers.
- Slack, Atlassian Jira and GitHub hold our internal notes, tasks and research files. Our rule is to write those notes by job title and company, not by name.
We also disclose information when the law requires it, to protect our rights or someone’s safety, or to a buyer if DistroCode LLC is sold or merged. A buyer would have to follow this policy.
Do we sell your personal information?
No. We don’t sell personal information.
How long do we keep it?
| What | How long |
|---|---|
| Messages and lead board records about people who don’t hire us | 24 months after our last contact |
| Client emails, quotes, invoices and payment records | 7 years, for tax and accounting |
| Form copy kept after an error, or the site and email kept after a site check | Up to 15 minutes |
| Scrambled codes used against spam and repeat requests | 10 minutes to 24 hours |
| Daily counts of LinkedIn visits and forms sent | 120 days |
| Google Analytics data | No longer than 14 months |
| Internal notes in Slack and Jira | As long as the workspace exists |
| An opt-out record | As long as we do outreach, so we keep honoring it |
When a period ends, we delete the information or remove anything that identifies you.
Where is your information stored?
Your information is likely to be stored or read outside your own country. Google, Stripe, LinkedIn, Anthropic, Slack, Atlassian and GitHub are US companies and keep data mainly in the United States. Our host may keep it in data centers in other countries. Our team reads the mailbox, the lead board, Slack and Jira from the countries where it works, which include countries outside the United States.
How do you see, fix or delete your information?
Email sales@distrocode.com with “Privacy request” in the subject and tell us what you’d like. You can ask:
- what we hold about you and where it came from;
- to correct it;
- to delete it;
- to stop all marketing and outreach.
We may ask you to confirm the request from the same email address or LinkedIn account, so we don’t hand your information to someone else. It’s free. We answer within 30 days, or within 20 working days where New Zealand law sets that limit. If we can’t do something, such as delete an invoice we must keep for tax, we’ll say so and explain why.
How do you make a complaint?
Email sales@distrocode.com with “Privacy complaint” in the subject. The owner handles it. We’ll confirm we have it within 5 working days and send a written answer within 30 days. If you’re still unhappy after that, you can complain to the privacy regulator where you live, listed below.
What rights do you have where you live?
United States. Wherever you live in the US, you can ask to know, correct or delete what we hold and to opt out of outreach, and we never treat you differently for asking. This page is our policy under the California Online Privacy Protection Act (CalOPPA), and the Do Not Track answer is in the cookies section above.
California residents: we don’t sell personal information. The California Consumer Privacy Act (as amended by the CPRA) covers a business only above set thresholds, such as annual gross revenue over US$26,625,000. DistroCode LLC is below them today, and we give you the same rights anyway. Other states’ laws have their own thresholds, and we handle requests from every state the same way.
Canada. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to personal information we handle in the course of commercial activity. We collect only what we need for the purposes above, ask before using it for anything new, and answer access requests within 30 days. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Australia. We follow the 13 Australian Privacy Principles of the Privacy Act 1988 for people in Australia, without relying on the exemption for businesses with an annual turnover of A$3 million or less. As APP 1.4(f) and (g) ask, we tell you that we are likely to disclose personal information to overseas recipients, and the section on where your information is stored says it is kept with our providers in the United States and in other countries where they run servers. You can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
New Zealand. The Privacy Act 2020 applies to overseas businesses that carry on business in New Zealand. We follow its Information Privacy Principles, including IPP 3A, in force since May 2026, which asks us to tell you when we collect information about you from somewhere other than you. This page is that notice for our outreach. You can ask for your information and ask us to correct it. If a privacy breach is likely to cause serious harm, we’ll tell you and the Privacy Commissioner as soon as we practicably can. You can complain to the Office of the Privacy Commissioner (privacy.org.nz).
Anywhere else. If you write from another country, we answer your request the same way.
How do we protect it?
Every page and form runs over HTTPS, and the site tells browsers to use HTTPS only. The forms check a signed time stamp and a spam trap before anything is mailed, and each connection can send only a few forms in ten minutes. The lead board runs on a machine we control that can’t be reached from the internet. If a breach puts you at real risk of harm, we’ll tell you and the regulators the law requires us to tell.
Is this site meant for children?
No. Our services are for businesses, and we don’t knowingly collect information from anyone under 16. If you think a child has sent us their details, email us and we’ll delete them.
What about links to other sites?
Our pages link to our LinkedIn page and to Fiverr, Trustpilot and PluginSprout, and blog posts link to their sources. Those are plain links, not embeds, so those sites learn nothing about you from our pages until you click. Once you’re there, their own privacy policies apply.
How will you know if this policy changes?
This version took effect on 18 October 2026. We’ll post any new version on this page and change the date at the top. If a change affects how we use information we already hold, we’ll also email our clients and anyone whose request is still open.
Questions?
Email sales@distrocode.com with “Privacy request” in the subject, or write to the mailing address near the top of this page.