safeuntil Privacy Policy

Effective Date: 2026-11-09

devrives ("we") cares about the personal information of people who use safeuntil. This policy explains what information is processed on safeuntil (safeuntil.devrives.com), a website that looks up how long a device will keep getting security updates, and what your rights are. safeuntil has no accounts and uses no fingerprinting or tracking pixels.

1. Purposes of Processing

We process information to provide the lookup of devices' security-update support periods, to fix data and reply to error reports and model requests you send, to email people who signed up for alerts about their devices (sign-up is closed for now), and to keep the service stable and secure. Only if you accept analytics cookies do we also process information to understand how visitors find and use the site and improve it.

2. Information Processed

1.Alert sign-up (closed for now): your email address, the device you chose, your language and timestamps, used only to email you about that device. Double opt-in: nothing is sent except confirmation email until you confirm. Alert emails go out when the device's status changes (for example to "Updates end soon" 12 months before the end date, or to "Updates ended"), when an end date is added or changed, and 90 and 30 days before a known end date; all your devices go into one email, at most one per day. To send them we keep, per sign-up, the status and dates we last told you about and which notices we already sent. We record nothing about whether you open an email or click a link (no tracking pixels, no tracked links).

2.Error reports (not accepted since October 22, 2026): for reports sent before then, your message, the page and, if you gave it, your email address, used only to fix the data and reply to you.

3.Model requests: the model you searched for and, if you give it, your email address.

4.Affiliate clicks: which link was clicked, the page it was on, the retailer region chosen from your country (one of US, UK, Germany, Japan or Korea) and the time. No IP address, no identifiers.

5."Check my phone": on the home page, visitors on a phone may see a box offering to check the phone they are using. Only after you tap "Check my phone" does the page ask your browser for the model name (Android browsers that support it share, for example, "SM-S911N") and search for it exactly as if you had typed it. The model name is not stored. If you tap "No thanks", your browser remembers that for 30 days in its own local storage (not a cookie, never sent to the server).

6.My devices: the devices on a "My devices" list are only in its link (the address); we build the page from the address and do not save it; only a failed request stays in the web server's error log (item 10). Your browser keeps the last list you opened in its own local storage, so "Add to my devices" on a device page adds to it. It is not a cookie and reaches the server only inside the address, when you open the list or use "Add to my devices". Clearing your browser's site data removes it.

7.Breach check: the breaches and steps on a check are only in its link (the address). We build the page from the address and do not save it; only when a request fails does the address stay in the web server's error log (item 10). Your browser does not keep the list in its local storage either; a list saved there before November 9, 2026 stays unused until you clear the site data. Only within the open tab, its session storage briefly holds the name of a breach you just added (to say so on the page it leads to) and, if you reload during an edit, the list's address with the edits not yet sent; both go when the tab closes. Google Analytics is never loaded on the breach check or on breach pages, even if you accept analytics.

8.Usage statistics (optional): only if you accept analytics in the cookie notice, Google Analytics 4 uses analytics cookies (_ga, _ga_*) to process the page you view (its address without the part after "?", so what you search for and the devices you compare are never sent), the page title, the referring site, campaign tags and ad click IDs (such as gclid) from the link you came in by, an approximate location derived from your IP address, browser, device type and screen size, scrolling and time on page, the address of a link to another site you click, and a few actions: that a search was made (not what), that a "Check price" link was clicked, that a form was started or submitted (not what you wrote), that a share, copy-summary or copy-address button was pressed (only which kind), and that a model request (and, when sign-up is open, an alert sign-up) was sent. Email addresses, form contents and the private links in alert emails are never sent, and alert pages do not load Google Analytics at all. If you do not accept, nothing is sent to Google.

9.Stored on your device: your cookie choice (accept or reject, with its time, language and policy version) and your language choice are kept in your browser's local storage, not in a cookie, and are never sent to us. Campaign tags from the link you came in by stay in your browser's session storage until you close the tab, and go to Google only if you accept analytics (item 8).

10.IP addresses and country: safeuntil never stores visitor IP addresses. Your IP address is held in memory for about 10 minutes only, to limit abusive form submissions, and is never written to disk. To pick the retailer for price links, the page uses the country Cloudflare derives from your IP address, without storing it. When a request fails (an error response), the web server's error log keeps the requested address (including the part after "?"), the response code and the time, and clears them after about 90 days; your IP address is not in it.

3. Location Information

safeuntil does not ask for your browser's or device's location permission and does not collect location information. Apart from the country used to pick the retailer for price links (Section 2, item 10; not stored), the retailer region recorded with an affiliate click (item 4) and, if you accept analytics, the approximate location Google Analytics derives from your IP address, no location is processed.

4. Retention and Deletion

Unconfirmed alert sign-ups are deleted after 7 days; confirmed sign-ups are kept until you unsubscribe or remove them. Every alert email has a one-click unsubscribe link, and unsubscribing deletes the sign-ups in that email, with their email address, immediately. On the "Manage my alerts" page, linked from every alert email, you can see your devices and remove one or all of them; removing deletes the sign-up and its notice history at once. Error reports and model requests are deleted automatically, every night, once they are 12 months old. Affiliate click records hold no IP address or identifier and have no set deletion date. Web server error logs are cleared after about 90 days. Database backups made before maintenance can hold the same information; they are deleted automatically, every night, once they are 30 days old. Google Analytics keeps user- and event-level data for 14 months, then deletes it; analytics cookies expire at most 2 years after your last visit, or when you clear them. Information stored in your browser stays until you clear it or your browser data is reset.

5. Processors and Transfers Abroad

We use the following processors to provide the service. Email delivery (alert emails, when sign-up is open): Resend (USA). The web server is in a France data center of Contabo GmbH (a German company), and every request passes through Cloudflare, Inc. (USA). Email addresses and the contents of alert sign-ups, error reports and model requests, and request information, are therefore processed abroad over the network. If you accept analytics, personal information is transferred abroad as follows. Recipient: Google LLC (USA, [email protected]). Items: the usage statistics in Section 2, item 8. When and how: sent over the network each time you use the site. Purpose and retention: website analytics, up to 14 months. Google is certified under the EU-US Data Privacy Framework and uses Standard Contractual Clauses. How to refuse and its effect: reject in the cookie notice, or withdraw consent with "Cookie settings" at the bottom of every safeuntil page; refusing changes nothing else on safeuntil. We do not sell your personal information and do not provide it to third parties for their own purposes.

6. Your Rights

You can ask to access, correct or delete your data, or to stop processing it, and you can withdraw consent at any time (unsubscribe from alerts, or reject analytics under "Cookie settings"). After you withdraw analytics consent, Google Analytics stops reading or writing its cookies and is no longer loaded from the next page on; cookies already set stay unused until you clear them. You can also complain to your data protection authority (in Korea, the Personal Information Protection Commission; in the EU, your national supervisory authority). The legal basis for alerts and usage statistics is your consent (GDPR Art. 6(1)(a)); for error reports, model requests, affiliate click records and the IP handling that prevents abuse it is our legitimate interest in accurate data and in protecting the service (Art. 6(1)(f)). To make a request, use safeuntil's error report form and write "privacy request", or contact us at the address below. Requests are answered within 10 days where Korea's PIPA applies, and within one month otherwise (GDPR).

7. Children's Privacy

safeuntil is not directed at children under 14 and does not knowingly collect children's personal information. If you believe a child's information has been collected, a parent or guardian can ask us to delete it or take other necessary steps.

8. Security Measures

We apply the technical and organizational measures needed to keep personal information safe, including HTTPS, access control (a password on the admin pages; the database is not exposed to the internet) and a design that processes as little information as possible.

9. Privacy Contact

Send questions about how your personal information is processed, or requests to exercise your rights, to [email protected]. We handle requests without delay as the law requires.

10. Changes

If we change this policy, we publish the effective date and the changes on this page. Important changes to your rights are announced in an easy-to-notice way before they take effect. This policy applies together with the devrives Privacy Policy and is effective from November 9, 2026. (October 20, 2026: moved here from the privacy policy published on the safeuntil website, with the server location and the processors and transfers abroad stated explicitly. October 23, 2026: item 6 retitled from "Home check list" to "My devices" and item 7 from "Data breach check" to "Breach check" after the menu and page names were changed; devices removed from item 7 because the breach check no longer takes them; error reports, no longer accepted since October 22, 2026, marked as such in item 2 and removed from items 7 and 8. November 9, 2026: the breach check no longer keeps your last list in the browser, so that text and "Forget this list" are removed from item 7, and the session storage it uses within the open tab is described. November 10, 2026: the contact address of Google LLC is corrected, and the effective date did not change)