Legal
Privacy Policy
We built Baton so developers can hand websites to their clients without handing over your privacy. This page explains, in plain language, what we collect, why, and the choices you have.
1. Who we are
Baton is a service that lets people who build websites hand them over to the clients who need to edit them. It is built and operated by Samuel Adefila (“Baton”, “we”, “us”). For the information described here, we are the controller of your account data. Contact us at samuel@adefilasamuel.com.
This policy covers the Baton website and app, and the small script we give you to install on a website.
2. What we collect
Your account. Your name and email address. Your password, which we never store as readable text: only a salted one-way hash that we cannot reverse. If you turn on two-step login, an encrypted authenticator secret and hashed recovery codes. Whether your email has been confirmed.
The sites you add. The site’s web address, the technology we detect it was built with, and the list of its pages that we find. The edits you save and publish (text, links, images, icons), every published version so you can roll back, who has access and in which role, invitations (including the invited email address), an activity log of who did what and when, and when each person was last active in the editor (shown to the other people on that site).
A WordPress connection, if you choose to add one. The WordPress username and application password you give us. The password is encrypted before it is stored and is used only to save your edits into your own site.
Images you upload. Stored so your site can display them. Uploaded images are served from a public address, so anyone with the link can see them.
Technical data. Your IP address and browser details appear in our servers’ logs. We also keep short-lived counters (which include your IP address or email) to limit repeated login, signup and reset attempts and so stop abuse. These expire within hours.
Email. We send you account emails: invitations, email confirmation, password resets and access requests. We do not send marketing email.
What we do not collect. No payment details (Baton is free during early access). No advertising or analytics trackers run on Baton.
3. People who visit a site that uses Baton
When a developer installs the Baton script on a client’s website, each visitor’s browser asks our servers for that site’s published edits. Our servers therefore receive the ordinary technical details of that request, such as the visitor’s IP address, browser type and the address of the site that made the request. We use this only to deliver and protect the service. We do not build profiles of visitors, track them across sites, or sell anything about them.
The script stores two small items in the visitor’s browser (local storage): a copy of the site’s published edits, so returning visitors see them instantly, and a timestamp so the install check is sent at most once every six hours. Neither contains personal information.
The owner of each website decides what to tell its visitors. For visitor data on a client’s site, we act on the site owner’s behalf and only to run the script.
4. Why we use your information
- To provide Baton: running your account, the editor, publishing, version history and sharing between developers and clients. This is needed to deliver the service you asked for.
- To keep it secure: preventing fraud, abuse and unauthorised access, and keeping the activity log. This is in our legitimate interest and yours.
- To communicate with you: account and security emails.
- To meet legal duties, and to establish or defend legal claims.
We do not sell your information, and we do not use it for advertising.
6. Where your data is kept
Our database runs in Ireland and our servers in Dublin. Our providers may process some data in other countries, including the United States. Where data moves across borders we rely on appropriate safeguards, such as the contractual protections our providers offer.
7. How long we keep it
- Account details: until you ask us to delete your account.
- A site and its versions, uploads and activity log: until a site owner deletes the site, or you ask us to delete your account.
- Password-reset links (1 hour) and email-confirmation links (24 hours) expire on their own and are stored only as hashes.
- Attempt counters: hours. Server logs: kept by our hosting provider for a short period.
After you delete something, copies in our providers’ backups can remain for a limited time. We aim to remove everything within 30 days.
9. How we protect it
Passwords are hashed with a slow, salted algorithm. Third-party credentials such as a WordPress application password are encrypted. Connections use HTTPS. You can turn on two-step login, and changing your password signs you out everywhere else. Edited text is cleaned on our servers before it is stored or shown, and the editor runs the page you are editing on a separate address from the app.
No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authority within the time the law requires.
10. Your rights
Depending on where you live, including under the Nigeria Data Protection Act 2023 and, if it applies to you, the GDPR, you may have the right to access your information, correct it, delete it, receive a copy, restrict or object to how we use it, and withdraw consent where we rely on it.
You can change your name and password and manage two-step login in Settings. For anything else, including a copy of your data or deleting your account, email samuel@adefilasamuel.com from the address on your account. We reply within 30 days. You also have the right to complain to the Nigeria Data Protection Commission or to your local data protection authority.
11. Children
Baton is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
We will update this page when our practices change and change the date at the top. For changes that matter, we will email you or show a notice in the app before they take effect.
13. Contact
Questions about privacy: samuel@adefilasamuel.com.