Privacy Policy

ZorForge OPC ("ZorForge", "we", "us") is a software development studio registered in the Republic of the Philippines. We are the personal information controller for the data described in this policy.

Registered office: [Registered office address — to be completed]
Contact: [email protected]

This policy covers this website and any account you create on it. Your use of the site is also governed by our Terms of Service.

It does not cover data we process on behalf of a client during a project engagement. Where we build or operate software for a client, that client is the controller, we act as their processor, and the terms of the signed engagement and any accompanying data processing agreement apply instead of this policy.

Information you give us

If you create an account, we store your name and email address. Email addresses are normalised to lowercase and must be unique. Your password is stored only as a bcrypt hash at cost factor 12 — we never store, log, or have any means of recovering the password itself.

If you use the contact form, we store the name, email address, company (optional), and message you submit, and email a copy to ourselves so we can reply. We deliberately do not record your IP address or browser with the enquiry — the form is protected by a hidden field and a rate limit instead.

If you sign up for the newsletter, we store your email address, signup and confirmation dates, and subscription status. We send a confirmation email before activating your subscription. Newsletter records do not include your IP address or browser.

If you email us directly, we hold that correspondence and whatever you chose to put in it.

Information collected automatically

When you sign in, we create a session record. Each session stores your IP address, your browser user-agent string, the account it belongs to, and a timestamp of last activity. We use this to keep you signed in and to investigate suspicious access.

Repeated sign-in attempts are rate limited. This writes a short-lived counter derived from the submitted email address and IP address, which expires within minutes.

Our web server keeps standard request logs. If the application encounters an error, the log entry may include request details.

We do not use analytics, advertising, profiling, fingerprinting, or any form of cross-site tracking. We do not build a profile of you and we do not track you across other websites.

Both are optional. If you enable them, we store the following.

• Two-factor authentication: a shared secret for generating time-based codes, and a set of single-use recovery codes. Both are encrypted at rest using the application's encryption key, and neither is ever displayed to anyone but you.
• Passkeys: a public key, a credential identifier, an authenticator model identifier (AAGUID), a signature counter, backup-eligibility flags, the time the passkey was last used, and a device label you can edit. The label is suggested from your browser's user-agent when you register the passkey.

Passkeys are public-key credentials: the private key never leaves your device and we never hold a secret capable of impersonating you. Deleting a passkey in your security settings removes our copy immediately.

We set four cookies and one local-storage entry. All are either strictly necessary for the site to function or store a display preference. None are used for analytics, advertising, or tracking, which is why this site shows no cookie consent banner.

Our Cookie Policy lists each one, what it does, and how long it lasts.

• To provide your account — signing you in, keeping you signed in, and showing you your own settings. Necessary for the service you asked us for.
• To keep the service secure — detecting and limiting abusive sign-in attempts, and letting you review the devices with access to your account. This rests on our legitimate interest in protecting the service and its users.
• To correspond with you — replying to enquiries and sending account emails such as password resets, which you trigger.
• For newsletter updates you request — after you confirm your email, we may send occasional updates about our work and tools. You can unsubscribe using the link in your subscription email.
• To meet legal obligations — where we are required to retain or disclose information by law.

We process personal information under the criteria for lawful processing in the Data Privacy Act of 2012 (Republic Act No. 10173). We do not sell personal information, and we do not use it to make automated decisions with legal or similarly significant effects.

This site loads no third-party scripts, embeds, iframes, fonts, or images. Our typeface is served from our own servers, so browsing this site does not disclose your IP address to a content delivery network or font host.

There is one outbound request involving your data, and it is designed so that your data is not exposed: when you set or change a password on our production site, we check it against the Have I Been Pwned breach corpus. This is done using k-anonymity — only the first five characters of a hash of the password are transmitted, and the password itself never leaves our server.

We otherwise share personal information only with service providers strictly necessary to operate the site (such as our hosting and email delivery providers, acting on our instructions), where required by law or lawful order, or in connection with a merger or acquisition, in which case we will tell you first.

• Account information — until you delete your account.
• Sessions (including IP address and user-agent) — expire after 120 minutes of inactivity and are then removed automatically. You can end them sooner by signing out.
• Password reset tokens — expire 60 minutes after being issued.
• Rate-limiting counters — up to one hour.
• Newsletter records — we retain your email and subscription status until you ask us to delete them. Unsubscribing immediately excludes you from the active subscriber list. Newsletter records are separate from website accounts.
• Application logs — rotated and deleted on a 14-day cycle.
• Contact form enquiries and correspondence — retained for as long as needed to handle your enquiry and for a reasonable period afterwards for our records. Contact enquiries are stored separately from accounts, so deleting an account does not remove them; ask us and we will delete yours.

We take the measures you would expect of a development studio, including: bcrypt password hashing at cost factor 12; encryption at rest for two-factor secrets and recovery codes; HTTPS in transit; HttpOnly, same-site session cookies; cross-site request forgery protection on every form; rate limiting on authentication; and support for two-factor authentication and passkeys so you can protect your own account.

No system is perfectly secure. If you believe you have found a vulnerability, please write to [email protected] and give us a reasonable opportunity to fix it before disclosing it publicly. We will not pursue action against good-faith security research.

Subject to the conditions and exceptions in the Data Privacy Act, you have the right to be informed, to access your personal information, to correct it, to object to processing, to erasure or blocking, to data portability, to damages, and to lodge a complaint.

Most of these you can exercise yourself: your name and email are editable in your profile settings, your active devices and passkeys are listed in your security settings, and you can delete your account at any time. For anything else, email [email protected] and we will respond within the period required by law.

If you are not satisfied with our response, you may complain to the National Privacy Commission of the Philippines.

If you are in the European Economic Area or the United Kingdom, you may also have rights under the GDPR or UK GDPR, including the right to complain to your local supervisory authority. We will honour those rights where they apply.

You can delete your account from your profile settings. It requires your current password and takes effect immediately — there is no grace period and no soft delete.

Deletion removes:

• your name, email address, and password hash;
• your two-factor secret and recovery codes, if you had them;
• every passkey registered to the account;
• all session records for the account, including the stored IP addresses and user-agent strings; and
• any outstanding password reset token.

Rotating application logs may retain incidental request records for up to 14 days, and we may retain correspondence you sent us. Backups, where held, are overwritten on their own cycle.

This site is intended for business use and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

We are based in the Philippines, and our infrastructure providers may process data in other countries. Where personal information is transferred outside your jurisdiction, we take reasonable steps to ensure it remains protected to a comparable standard, and we remain accountable for it.

We may update this policy as the service changes. The "last updated" date at the top always reflects the current version. If we make a change that materially affects how we handle your personal information, we will notify account holders by email or by a notice on the site before it takes effect.

Questions about this policy, or about the personal information we hold, should go to [email protected], or by post to ZorForge OPC, [Registered office address — to be completed].