What this site collects, and what it does not.
This page describes what werun.dev actually does, read out of the code that runs it. There is one form, one cookie, and two files loaded from somebody else's server.
What the brief form stores.
The form on the contact page sends exactly the fields you can see, and they are written to our own PostgreSQL database:
- Name and work email — required, so we can reply.
- Company, platform and budget range — optional context.
- Your brief — the free-text description of what you need.
- A keyed hash of your IP address, used only to stop the same address submitting the form repeatedly. It is an HMAC, not the address: we store the hash and cannot recover the address from it.
Nothing else is captured with a submission — no browser fingerprint, no referrer, no profile. The form is not connected to any advertising or marketing platform. We use what you send to answer you and to scope the work you described.
Two, and one of them counts visits.
werun_session holds a signed sign-in token for the werun.dev admin area and the project tracker. It is httpOnly (JavaScript cannot read it), SameSite=Lax, and it is only ever set when somebody on our team or a client signs in. Reading the public site never sets it.
Google Analytics 4 runs on the public pages and sets its own _ga cookies to tell a returning visitor from a new one. We use it to see which pages get read and whether the brief form gets finished — nothing more. It does not run on /admin or on crm.werun.dev: a client's use of their own project tracker is not something we measure.
There is no advertising, remarketing, attribution or session-replay script anywhere on this site, and nothing here is linked to an ad network.
The WelcomeAI assistant described below runs inside your browser. Any storage it creates is its own, governed by WelcomeAI, and we do not read it.
When the brief form is sent we tell Analytics that a brief was sent, along with the platform and budget range you picked from the dropdowns. Your name, your email address and the brief itself are never sent to Google — they go to our own database and to our own inbox, and nowhere else.
The two things we load from elsewhere.
- WelcomeAI (
cdn.welcomeai.dev) — the assistant launcher and the search box on the home page. It is our own product, embedded here the same way our clients embed it. Anything you type into it is handled by WelcomeAI. - Font Awesome (
cdnjs.cloudflare.com) — the icon stylesheet and its webfonts.
Loading a file from another server means that server sees the request: your IP address, your browser's user agent, and which page asked for it. That is true of every third-party file on every website, and it is the reason this list is short.
Everything else is served by this application. Article images come out of our own database through this site's own URLs — there is no image CDN, no font host beyond the one named above, and no embedded video, map or social widget.
Getting your brief removed.
Write to hello@werun.dev and ask for a copy of what we hold about you, or for it to be deleted. The contact form is the only place this site collects anything, so in practice that means the brief you sent and the reply thread it started.