Some links on this page are affiliate links. If you buy, we may earn a commission — at no extra cost to you.

Sun 19 Jul 2026 · 13:21 GMT
tuto.digital

EN

Home / Privacy Policy

Privacy policy

How tuto.digital collects, uses and protects your information — written in plain language. No legalese, no surprises.

tuto.digital · EditorialEffective June 11, 2026~6 min read

Contents
01The short version 02What we collect 03How we use it 04Affiliate clicks 05Cookies & tracking 06Who we share with 07Your rights (GDPR/CCPA) 08Data retention 09Children 10Changes & contact 11Tuto Apps
Reading progress
Effective date
June 11, 2026
Last updated
July 6, 2026
Data controller
tuto.digital
Jurisdiction
TRNC (North Cyprus)

This policy describes what data we collect, why, and what control you have over it. tuto.digital is operated from the Turkish Republic of Northern Cyprus (TRNC) and runs with strictly necessary cookies only — no analytics cookies, no third-party trackers, no ad networks. We follow GDPR (EU) and CCPA (California) as our minimum bar for readers everywhere.

01 — SummaryThe short version

If you don’t read another section, read this one:

  • We do not sell your personal data to anyone — ever.
  • We currently run no analytics at all. If we ever add traffic measurement, it will be cookie-less (e.g. Cloudflare Web Analytics) — no personal identifiers, no fingerprinting, no cross-site profile — and this policy will be updated first.
  • We do not use Google Analytics, Microsoft Clarity, Facebook Pixel, or any third-party ad/tracking network.
  • We don’t run programmatic display-ad or retargeting networks. The few clearly-labeled sponsor placements we show are static links — they set no advertising cookies and don’t track you.
  • The only cookies we set are strictly necessary ones for site function (language/theme preference). No consent banner is required because we set no tracking cookies.
  • We run an opt-in email list (deal digest / newsletter). We only add people who submit the form themselves, confirmed via double opt-in (a confirmation email). We never buy lists or add anyone without consent. Subscriptions are handled by Elementor Pro on our own WordPress installation — your address stays in our own database and is not passed to an external email-marketing service.

02 — DataWhat we collect

Automatically when you visit

  • Cloudflare edge logs — aggregated request data (status code, country, referrer, browser family) used for security, caching and DDoS protection. Cloudflare does not store full IP addresses for analytics purposes; see the Cloudflare privacy policy.
  • Analytics — none today. If enabled in the future, it will be cookie-less and privacy-preserving (page views, referrers, country-level location only — no individual visitor identified or followed across sessions), and this section will be updated before it goes live.
  • Affiliate click events — when you click an outbound merchant link, we record an anonymous count of the click for revenue attribution. No personal identifier is attached.

When you contact us

  • Email address — if you write to us so we can reply.
  • Name (optional) — only if you provide it via the contact form.
  • Message content — what you write to us.

When you subscribe to our email list

  • Email address — the only field required to subscribe.
  • Signup timestamp & consent record — the date and time you subscribed and confirmed, retained as proof of consent.
  • Source page & IP at signup — which page you subscribed from and the IP address at that moment, retained for spam protection and as proof of consent.

What we don’t collect

  • Payment details — purchases happen on the merchant’s site, not ours.
  • Government IDs, phone numbers, addresses.
  • Anything from minors under 16 (see Section 09).

03 — UseHow we use your data

We use the data above for these specific purposes, and no others:

  1. Site operations — keeping the site fast, secure, and reachable.
  2. Performance analysis — understanding which articles readers find useful and what to write next (aggregate metrics only).
  3. Affiliate revenue — tracking which links result in purchases so we receive commissions.
  4. Communication — answering questions you send us.
  5. Email list — to send the deal-digest/newsletter you asked for, on the basis of your consent (GDPR Art 6(1)(a)).
  6. Fraud prevention — detecting and blocking abuse, bots, scrapers.

04 — AffiliatesAffiliate click tracking

When you click a link to a merchant (Hostinger, NordVPN, etc.), three things happen:

  1. We increment an anonymous click counter on our side — no personal identifier is logged.
  2. You’re redirected to the merchant with a tracking parameter (e.g. ?ref=tutodigital) appended.
  3. The merchant drops their own cookie on your browser; if you purchase within their cookie window (typically 30 days), we receive a commission.

The affiliate cookie is set by the merchant, not by us. It costs you nothing — the commission comes from the merchant’s marketing budget, not from a markup on your purchase.

⚐ How to opt out

If you’d rather purchase without us being credited, type the merchant’s name into a new browser tab instead of clicking our link. No data leaves our site in that case.

05 — CookiesCookies & tracking technologies

tuto.digital sets only strictly necessary cookies — the kind that don’t require consent under GDPR/ePrivacy. There is no consent banner because we have nothing to ask consent for.

  • td_lang — remembers your language preference (EN/FR/DE). Duration: 12 months. First-party.
  • td_theme — remembers your light/dark reading mode. Duration: 12 months. First-party.

That’s the entire list. We do not set:

  • Analytics cookies (we run no analytics; any future measurement will be cookie-less)
  • Advertising or retargeting cookies
  • Social-media tracking pixels
  • Cross-site fingerprinting scripts

If you block all cookies in your browser, the only thing you lose is your saved language and theme preference — the site still works.

06 — SharingWho we share data with

We share data only with the processors below, each bound by a Data Processing Agreement (DPA):

  • WPX Hosting — managed WordPress hosting (UK); our site database, contact-form messages and newsletter subscriber list live on WPX infrastructure
  • Cloudflare — CDN, DDoS protection and security at the edge (US, DPF certified)
  • Affiliate networks — Impact, ShareASale, CJ — receive only the anonymous click event needed for attribution
  • Elementor Pro — powers our forms and newsletter on our own WordPress installation; subscriber data is stored in our own database on WPX, not on external servers

We do not sell your data. We do not share data with advertisers, data brokers, or any third party outside this list. We do not use Google Analytics or any equivalent.

International transfers

tuto.digital is operated from the Turkish Republic of Northern Cyprus (TRNC). Your data is stored on WPX Hosting infrastructure in the United Kingdom, which the European Commission has recognised as offering an adequate level of data protection (Decision 2021/1772). Cloudflare processes request metadata in the United States under the EU–US Data Privacy Framework (Decision 2023/1795). Affiliate networks (Impact, ShareASale, CJ) operate under Standard Contractual Clauses (2021/914 module 2) where they are not yet DPF-certified. No transfers occur to any country without an adequacy decision or supplementary safeguards.

07 — RightsYour rights under GDPR & CCPA

Regardless of where you live, you have these rights:

  • Access — request a copy of the data we hold about you
  • Correction — ask us to fix anything inaccurate
  • Deletion (“right to be forgotten”) — ask us to delete your data
  • Portability — receive your data in a machine-readable format
  • Opt-out — refuse affiliate tracking or any future communications
  • Withdraw consent — unsubscribe at any time via the link in every email; withdrawal doesn’t affect the lawfulness of processing carried out before it
  • Complain — to your local data protection authority, without contacting us first

To exercise any of these, use the contact form. We respond within 30 days, free of charge.

08 — RetentionHow long we keep data

  • Cloudflare edge / security logs — retained by Cloudflare per their default policy (typically under 30 days); we keep no copy
  • Contact-form messages (Elementor Pro submissions, stored in our WordPress database on WPX) — deleted 24 months after the last reply
  • Newsletter subscriber list (Elementor Pro, our own database on WPX) — kept until you unsubscribe, then purged within 30 days; the consent record (signup timestamp, source, IP) is retained separately as proof of lawful processing
  • Affiliate click counters — aggregate numbers only; no per-visitor record exists to retain
  • WPX server backups — rotate automatically on WPX’s standard schedule (typically ≤ 28 days); deleted data drops out of backups as they cycle

09 — ChildrenChildren's privacy

tuto.digital is intended for adult readers (16+). We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it immediately.

10 — Changes & contactUpdates to this policy

We may update this policy occasionally — for example, when changing a hosting provider or adding a merchant partner. If we ever introduce a new analytics or tracking tool, this policy will say so before it goes live, and we will publish a notice at the top of the homepage for 30 days.

The version history is published transparently — write to us if you’d like to see a previous version.

Questions about your data?

Reach us via the contact page — a human responds within 48 hours. For formal GDPR/CCPA requests, expect a 30-day legal response window.

11 — Tuto AppsSelf-hosted apps (app.tuto.digital)

Beyond the editorial site, we offer Tuto Apps — tools that set up self-hosted software inside your own cloud account (e.g. DigitalOcean). The first is Tuto VPN; more will follow (hosting, mail and other self-hosted services), and this same section covers all of them, because they share one privacy model — unusual, and in your favor.

The core idea: it’s your server, not ours.
When you deploy anything with a Tuto App, the server is created in your cloud account, billed to you by your provider, and controlled by you. We are not in the data path. Whatever runs on that server — a VPN, a website, a mail service — its traffic and its content flow between your devices and your server, never through Tuto’s infrastructure.

What we store:

  • A session cookie — so you stay signed in. HttpOnly, first-party, expires automatically.
  • Deployment metadata — the list of servers and apps you created through Tuto (provider region, size, which app, status), so your dashboard works. Sensitive values in it (access keys, configurations) are stored encrypted (AES-256-GCM).
  • An OAuth token for your cloud provider — stored encrypted, used only to perform the actions you request (create, list, resize, delete servers). You can revoke it in your provider’s dashboard at any time, which cuts our access instantly and completely.

What we never see or store:

  • Your traffic or content. VPN traffic, website visitors, mail — none of it passes through us. Ever.
  • Your DNS queries. Resolved on your own server; where we install a resolver, we configure it with query logging disabled by default.
  • Your identity. Tuto Apps require no name, no email, no phone number.
  • Your cloud provider password. Sign-in happens on your provider’s own page (OAuth); we only ever receive a scoped token.

What your cloud provider sees: your relationship with DigitalOcean (or another provider) is governed by their privacy policy — they bill you, they see their own infrastructure logs. That was true before Tuto and stays true with it.

Data deletion: removing a server deletes its metadata from our records. Revoking the OAuth token and deleting your servers leaves us with nothing that identifies you.