Privacy Policy
1. Who is responsible for the site
DryRights is operated by Vitaliy Maliborskiy, an individual entrepreneur registered under the laws of Ukraine (Ukrainian: фізична особа — підприємець), Taxpayer Identification Number 2648903317, trading as DryRights.
Privacy contact:
Address for legal notices:
bulvar Nezalezhnosti 6, apt. 317, Kalush, Ivano-Frankivsk Oblast, Ukraine, 77304
2. Data we process
Public website use
Browsing public pages and completing open route checks does not require an account.
Servers may technically process standard request data such as IP address, time, requested URL, browser type, operating system, response code and security logs.
Analytics
Analytics hosted through stats.dryrights.com is a self-hosted Umami instance running on DryRights' own infrastructure — not a third-party cloud service.
Analytics does not set cookies (technically confirmed — no Set-Cookie header is sent). Per the documented behaviour of the Umami version in use, raw IP addresses are not stored — a hashed visitor identifier (IP + User-Agent + a daily salt) is used instead and rotates daily; the analytics script may use browser local storage (localStorage) solely for this transient identifier, not for personal data. Exact events collected: page viewed, approximate country, device type, referral source, aggregated route-interaction events.
Contact messages
The /contact page has no form — contact happens directly by email, by topic (partnership, Horizon Europe, error report, accessibility). Such messages are held in your and our mailbox under the standard policy of the email service, not in a separate DryRights database.
Error reports
The /report-error form processes: language, page URL, error category, description (20–4,000 characters) and an optional reply email. The form is anonymous — not tied to an account or session. For abuse prevention, only a hashed IP address (SHA-256 of IP plus a daily salt) is stored separately to enforce rate limits — the raw IP address is never stored and is never linked to the message text.
3. Purposes
- operating the website;
- information security;
- diagnosing errors;
- aggregate analytics;
- responding to messages;
- reviewing reported errors;
- product development and testing;
- meeting legal obligations.
4. Legal bases
Depending on the situation, data may be processed to provide a requested service, respond to a message, comply with a legal obligation or pursue a legitimate interest in operating and improving the service securely. Where consent is required for a specific function, it is requested separately.
5. Cookies and browser storage
As of this version, the public website does not set cookies and does not store your answers to interactive route tools (for example, the medical-eligibility test) in localStorage or sessionStorage — they exist only in the page's memory during the browsing session and disappear on refresh or when the page is closed.
Language is determined by URL: Ukrainian without /en/, English with /en/.
If this changes, the policy will be updated and consent will be requested where legally required.
6. Recipients
Data may be processed by:
- hosting provider — OVHcloud SAS (France);
- email provider — Porkbun (the domain registrar's forwarding service, relaying to the operator's personal mailbox);
- analytics provider — self-hosted (DryRights' own infrastructure, the same server as the website);
- contracted support providers where necessary;
- competent authorities where disclosure is legally required.
DryRights does not sell personal data.
7. International transfers
The website's hosting is physically located in France (EU). Where another provider processes data outside the user's country, appropriate contractual and legal safeguards are applied. The providers are identified above.
8. Retention
- security/technical logs: currently not automatically rotated (a technical task to add rotation is planned);
- aggregate analytics: currently retained with no automatic deletion schedule — a technical task to add rotation is planned;
- contact messages: not retained separately by DryRights (see section 2 — direct email, not a form);
- error reports: the optional reply email is automatically deleted after 90 days; the problem description and page URL may be retained longer for content-quality purposes, without an identifying email; the IP hash used for abuse prevention is deleted after 48 hours.
9. Your rights
Depending on applicable law, you may have rights of access, correction, deletion, restriction, objection, data portability and complaint to a supervisory authority.
Contact: partnerships@dryrights.com
A proportionate identity check may be required. Do not send a passport copy unless specifically instructed through a secure process.
10. Security
We apply proportionate technical and organisational measures. No internet transmission can be guaranteed to be completely secure.
11. Children
DryRights is not intended for young children to create accounts independently. Where a route concerns a child, it should be used by a parent, guardian or other authorised person.
12. Changes
Material changes are published on this page. Previous versions may be retained in an archive.
Last updated: 7 September 2026