Privacy policy
Last updated November 9, 2026.
This policy explains what personal information spillwaycms.com collects, why, who handles it and the choices you have. The site is operated by KWALL LLC, a company in the United States ("we", "us"). It covers this website, its blog and documentation, and the package registry at spillwaycms.com/registry. It does not cover websites that other people build and run with the Spillway software: each of those has its own operator and its own policy.
The short version
- We count visits without cookies and without storing anything that identifies you.
- We set optional cookies, and load videos and other content from other sites, only if you agree. You can change your choice at any time from Cookie settings at the bottom of every page.
- We do not sell your personal information, we do not share it for advertising, and we do not use it to advertise to you.
- You can ask to see, correct or delete your information by writing to hello@spillwaycms.com.
What we collect
When you visit the site
Visit statistics. Our built-in counter records the page you viewed, the website that sent you, campaign tags in the address (such as utm_source) and your screen width. We keep only daily totals. To count unique visitors, the server combines your IP address and browser details with a random key that changes every day and is held only in memory; the result is never stored, so the totals cannot be traced back to you. Bots and automated tools are not counted. The counter sets no cookies.
Server and security logs. Like any website, our servers and our hosting provider process your IP address, your browser details and the address you asked for in order to deliver the page and to protect the site from abuse, for example by limiting how fast one address can send requests. These logs are kept only as long as needed for security and troubleshooting.
When you sign up for the newsletter
Your email address, your name if you give it, and the topics you choose. With the sign-up we also record the page you signed up on, any campaign tags, your IP address and your browser details, to prevent spam and to see where sign-ups come from. We use this to send you the newsletter. You can unsubscribe at any time from the link in any issue or by writing to us.
When you rate a documentation page
Your answer to "Was this page helpful?", any comment you write, and which page and version it was about. Please do not put personal information in the comment.
When you publish to the registry
- Your account: your name and email address. If you sign in with GitHub, we receive your GitHub user ID and username; we never see your GitHub password. If you use a password with us, we store only a secure hash of it. API tokens are stored as hashes too.
- What you publish is public by design: your publisher name and profile, your organizations, and each package's name, versions, files, README, publish dates and download counts.
- A record of account actions, such as publishing, signing in and changing settings, kept to protect your account and the registry.
When you write to us
Your email address and whatever you choose to tell us.
Why we use it
If you are in the European Economic Area, the United Kingdom or Switzerland, these are the legal bases we rely on:
| Purpose | Information | Legal basis |
|---|---|---|
| Deliver the site and keep it secure | Logs, IP address, browser details | Our legitimate interest in running a safe website |
| Count visits | Daily totals only | Our legitimate interest in knowing which pages help people; no personal data is stored |
| Send the newsletter | Email address, name, topics | Your consent, which you can withdraw at any time |
| Run your registry account and publish your packages | Account details, packages | Our contract with you (the terms of use) |
| Improve the documentation | Page ratings and comments | Our legitimate interest in useful documentation |
| Answer messages and requests | Your message and email address | Our legitimate interest in replying, and legal obligations for privacy requests |
| Optional cookies and embedded content | As described in the cookie notice | Your consent |
Cookies
We use a few cookies that the site needs to work, such as the one that remembers your cookie choice and the one that keeps registry publishers signed in. Optional cookies, and content embedded from other sites, wait until you allow them. The cookie notice lists every cookie, what it does and how long it lasts.
Who handles your information
We use these service providers, who process information only on our instructions:
- Fly.io hosts the site. Our servers are in Amsterdam, the Netherlands.
- Cloudflare stores our encrypted backups.
- Our email delivery provider sends the newsletter and account emails.
- GitHub, only if you choose to sign in with GitHub. GitHub's own privacy statement covers your GitHub account.
We may also disclose information when the law requires it, to protect the rights, property or safety of our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply to your information.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
International transfers
We are based in the United States and our servers are in the European Union, so your information may be processed in both places and wherever our providers operate. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses offered by our providers.
How long we keep it
- Visit statistics: daily totals for up to 400 days. They contain no personal data.
- Newsletter: until you unsubscribe or ask us to delete your sign-up.
- Documentation ratings: as long as they help us improve the documentation.
- Registry accounts: while your account is open. When you ask us to close it, we delete your account details within 30 days. Package versions you published may stay in the registry, because other people's sites depend on them, but we remove your personal details from them where we can.
- Messages: as long as needed to deal with them.
- Backups: overwritten on a rolling schedule, so deleted information leaves our backups within a short time.
Your rights
Depending on where you live, you have the right to ask us for access to your personal information and a copy of it, to correct it, to delete it, to receive it in a portable format, to restrict or object to how we use it, and to withdraw your consent at any time. We honor these requests for everyone, wherever you live.
Write to hello@spillwaycms.com. We may ask you to confirm the request from the email address we have on file, so that we give information only to the right person. We reply within 30 days, and tell you if we need longer as the law allows. If you are in the EEA, the UK or Switzerland, you also have the right to complain to your data protection authority.
California residents have additional rights, described in our California privacy notice.
Global Privacy Control
If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale and sharing of your personal information and keep marketing cookies and embedded content off, without asking. Because there is no common standard for "Do Not Track", we do not respond to it, but we do not track you across other websites either way.
Children
This site is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, write to us and we will delete it.
Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we say so on this page and, where we have your email address for the newsletter, in the next issue.
Contact
KWALL LLC, United States. Email hello@spillwaycms.com. To report a security issue, see the security page.