Privacy Policy & Cookie Governance
Đại Việt (daiviet.dev) is an open-source, decentralized AI benchmark aggregator, GitHub trending analytics engine, and model cost comparison platform. Transparency, privacy preservation, and community stewardship are fundamental pillars of our engineering.
01Overview & Open-Source Philosophy
Đại Việt (daiviet.dev) is developed and maintained as an open-source initiative for the benefit of developers, AI researchers, and the broader global artificial intelligence community. We do not sell, rent, monetize, or broker personal data. Our operations do not involve behavioral profiling, advertising trackers, cross-site remarketing, or user surveillance.
The primary purpose of this platform is to aggregate published foundation model benchmarks, track autonomous agent capabilities across standardized harnesses, normalize token pricing across inference providers, and calculate real-time star velocity on viral open-source repositories.
02Information We Process & Telemetry Scope
2.1 Public Repository & AI Benchmark Telemetry
We collect and index publicly available metrics from external platforms, including GitHub public repositories (star counts, fork counts, primary programming languages, open issue counts), benchmark results published by independent evaluation organizations (LMSYS Arena, SWE-bench Verified/Pro, LiveCodeBench, Scale SEAL, GAIA, etc.), and publicly listed model inference rates from OpenRouter, Hugging Face, and LiteLLM. We never inspect or access private repositories, confidential codebases, or proprietary data.
2.2 Rate Limiting & Transient In-Memory IP Processing
To protect our backend infrastructure against automated denial-of-service (DDoS) loops, abusive scraping, and resource starvation, client IP addresses are processed in volatile memory by our reverse proxy (Nginx) and Next.js proxy (src/proxy.ts). These timestamps are kept in ephemeral sliding windows solely to enforce the 10 req/s (burst 20) and 60 req/min fair usage thresholds. They expire automatically within 60 seconds and are never permanently stored, correlated with individual identities, or shared with third parties.
2.3 Network Access Boundaries & Internal API Isolation
Public analytical endpoints (/api/trending, /api/benchmarks, /api/agents, /api/catalog) are openly accessible to visitors globally. In contrast, internal-tier programmatic APIs (/api/v1/*) and internal backend ports (MySQL :3306, Model Catalog :8000, Next.js Web :3000, Redis :6379) are restricted strictly to internal RFC 1918 private subnets and local loopback interfaces. Unverified external connections to internal APIs are automatically rejected with an HTTP 403 Forbidden status.
2.4 Multi-Tier Caching & In-Memory Redis Store
To ensure sub-millisecond responsiveness and decouple availability from external upstream outages, we employ multi-tier caching via an Nginx disk cache (daiviet_cache) and an in-memory Redis 7 instance. Cached entries store only publicly aggregated benchmark ratings, repository velocity tables, and normalized catalog metadata. No personal data, authentication secrets, or visitor identifiable information is ever stored within the cache tiers.
2.5 Technical Infrastructure & Access Logs
Standard web server access logs are maintained by Nginx for security auditing, DDoS defense, and diagnostic troubleshooting. These records include IP address, HTTP request method, requested URI, referrer header, user-agent string, and response status code. Server logs are automatically rotated and permanently purged after 30 days.
2.6 Local Browser Storage
We use browser localStorage solely to preserve non-sensitive client UI preferences, including your active tab, selected models in the Model Comparator modal, customized table sort orders, and your cookie consent preference record (daiviet_cookie_consent_v1). This data resides exclusively on your local device and is never transmitted to our servers or external services.
2.7 Strictly Necessary First-Party Cookies
When you submit your cookie preferences via our consent banner, a single first-party cookie named daiviet_consent (value: all or essential) is set with a 1-year expiration, SameSite=Lax, and the Secure flag. This cookie is strictly necessary to remember your privacy choices and avoid displaying the prompt on subsequent visits.
2.8 Voluntary Communications
If you contact our maintainers via email at [email protected], we collect your email address and message contents solely to respond to your technical inquiries, repository inclusion/removal requests, or bug reports.
03Cookie Policy & Web Analytics Governance
We believe in transparent, consent-first data practices. We categorize all browser cookies and local storage tokens into two distinct tiers:
Strictly Necessary
Required for site operation, edge rate limiting, and remembering your consent preferences (daiviet_consent). These cookies do not track you across websites and are legally exempt from requiring prior consent under ePrivacy Directive Article 5(3) and GDPR Recital 30.
Performance & Analytics
Google Analytics 4 (_ga, _ga_*) aggregates anonymized traffic, page load metrics, and leaderboard interaction trends. These scripts remain completely disabled unless you affirmatively grant permission via the cookie consent banner.
Google Analytics 4 Implementation & Consent Mode v2 Safeguards
When analytics telemetry is enabled (NEXT_PUBLIC_GA_MEASUREMENT_ID), our implementation enforces privacy protections via Google Consent Mode v2:
- Default Denied State: Before you make a selection,
analytics_storagedefaults to'denied'. - Strict Prohibition of Advertising Signals: Commercial advertising tags (
ad_storage,ad_user_data,ad_personalization) are unconditionally hardcoded to'denied'regardless of consent choice. - IP Anonymization: IP masking (
anonymize_ip: true) is enforced, truncating client IP octets before transmission to analytics servers. - Zero Cross-Site Tracking: Google Signals, User-ID cross-device tracking, and ad remarketing integrations are disabled.
You can update or withdraw your consent at any time without penalty. Changes take effect immediately.
04How We Use Information
- Operating the Aggregator: Calculating 15-minute, 24-hour, and 7-day GitHub star velocity deltas, aggregating multi-source benchmark scores, and rendering multi-model cost comparisons.
- Rate Limiting & Abuse Prevention: Enforcing rate limit quotas (10 req/s, burst 20, 60 req/min) to safeguard service availability for all users.
- Platform Performance & Latency Optimization: Analyzing aggregate page visit metrics and cache hit ratios (when consented) to optimize API endpoints and background ingestion schedules.
- Data Integrity & Attribution: Ensuring benchmark results are accurately linked to verified academic, community, and industry testing sources (LMSYS, Scale AI, SWE-bench, LiveCodeBench, etc.).
- Community Support: Responding to user feedback, bug reports, repository inclusion/removal requests, and collaboration inquiries.
05Third-Party Processors & International Data Transfers
To deliver our services, we interact with specific third-party service providers and public API endpoints:
If you grant analytics consent, Google LLC processes aggregated telemetry on our behalf. Data transfers to Google servers in the United States and globally are safeguarded under European Commission Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework. You can review Google's Privacy Policy at policies.google.com/privacy or install the Google Analytics Opt-out Browser Add-on.
Our background ingestion worker queries the public GitHub Search API to calculate star velocity. No user personal data is transmitted from visitors to GitHub.
Our services operate in the OCI Singapore cloud region with encrypted SSD volumes, strict local loopback bindings for internal databases, and private Docker network segmentation.
We do not share, sell, or disclose your data to advertising exchanges, data brokers, or marketing syndicates.
06Regulatory Compliance & Data Subject Rights
Depending on your jurisdiction, you possess specific legal rights regarding any personal data we process:
General Data Protection Regulation (GDPR) & ePrivacy (EU / UK)
Under Regulation (EU) 2016/679, you have the right to access, rectify, erase, restrict processing of, or object to the processing of your personal data, as well as the right to data portability. You have the absolute right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You also have the right to lodge a complaint with your local supervisory authority.
California Consumer Privacy Act (CCPA / CPRA)
California residents have the right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate personal information, and the right not to receive discriminatory treatment. We do not sell and do not share personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.
Vietnam Decree 13/2023/ND-CP & Cybersecurity Law
In compliance with the Vietnamese Law on Cybersecurity and Personal Data Protection Decree (Decree 13/2023/ND-CP), we uphold the fundamental principles of purpose limitation, data minimization, and transparency. Under Article 9 of Decree 13/2023/ND-CP, data subjects possess the right to know, right to give or withhold consent, right to access, right to withdraw consent, right to request data deletion, and right to self-protection.
Open-Source Repository Maintainer Opt-Out
If you are the author or designated maintainer of a public open-source repository tracked on our trending board and wish to have your repository excluded from automated star velocity tracking, please submit an opt-out request with proof of ownership to [email protected].
07Contact & Data Protection Inquiries
For inquiries regarding this Privacy Policy, cookie governance, data protection rights, or repository inclusion/exclusion requests, please reach out to our official contact channel: