Privacy.

Who is responsible

I am. Asif Iqbal, an individual based in Dhaka, Bangladesh, decides how this data is used. Write to [email protected] about anything on this page.

This notice is written for the EU and UK General Data Protection Regulation (GDPR) and California’s Online Privacy Protection Act. The rights below apply to everyone, wherever you live.

What I collect, and why

• Reading the site

  What

  Your IP address, browser details, and the pages you request, as part of every web request. One setting, your light or dark theme, is saved in your own browser and never sent to me.

  Why

  To deliver pages and keep the site safe from abuse.

  Legal basis

  GDPR: legitimate interest in running a working, secure site. There are no analytics, ads, tracking cookies, or third-party fonts.

  Who receives it

  My server, which runs in Bangladesh, and Cloudflare, which sits in front of it as a network and security service.

  How long

  Server logs are deleted within 30 days. Cloudflare keeps its own logs under its privacy policy.

• Sending a message

  What

  Your name, email address, and message. Your IP address is checked by Cloudflare Turnstile to stop bots, and counted against a limit of five messages an hour.

  Why

  To read and answer your message.

  Legal basis

  GDPR: steps you ask me to take before we work together, and my legitimate interest in answering mail. Sending the form is that request.

  Who receives it

  My Gmail inbox (Google), a private Slack channel that notifies me, and Mailgun (US), which sends you the confirmation email.

  How long

  Up to two years after our last exchange, or sooner if you ask. Slack copies go after 90 days. The IP count lives only in server memory and is gone within an hour. I never store the IP itself.

• Getting new posts by email

  What

  Your email address, and the time and IP address of your sign-up and confirmation, which prove you agreed.

  Why

  To send one email when I publish.

  Legal basis

  Your consent, given when you confirm the link Mailchimp emails you. You can withdraw it at any time, and doing so doesn’t affect emails already sent.

  Who receives it

  Mailchimp (Intuit, US). Open and click tracking is off.

  How long

  Until you unsubscribe through the link in any email. Mailchimp then keeps your address on a do-not-email list so you aren’t added back by mistake. Ask, and I’ll delete it permanently.

Data sent outside your country

Mailchimp, Mailgun, and Slack store data in the United States. Google (Gmail) and Cloudflare run worldwide. Each acts only on my instructions under its data processing terms. Data leaving the EU and UK is protected by the EU–US Data Privacy Framework where the provider is certified, and by the EU Standard Contractual Clauses where it isn’t.

If you book a call from the link in my reply, Google Calendar handles that booking under Google’s own privacy policy.

Your rights

• See the data I hold about you and get a copy.
• Have it corrected or completed.
• Have it deleted.
• Object to, or ask me to limit, how I use it.
• Withdraw consent for the newsletter at any time.
• Get it in a portable format.

Email [email protected] with the subject “Privacy request”. I answer within 30 days. To make sure I only hand data to its owner, I may ask you to write from the address you used.

You can also complain to a data protection authority: in the EU or EEA, the one where you live or work; in the UK, the Information Commissioner’s Office. I’d like the chance to fix things first, but you don’t have to ask me.

If you live in California

In the last 12 months this site has collected these categories of personal information, all directly from you or your browser, for the purposes above:

• Identifiers: name, email address, IP address.
• Internet or network activity: pages requested and browser details, in server and Cloudflare logs.
• The content of messages you send me.

I disclose them only to the service providers listed above, under contracts that limit their use to running this site. I don’t sell or share personal information, including for cross-context behavioral advertising, and I haven’t in the last 12 months. I don’t sell the data of anyone under 16, collect sensitive personal information, or give personal information to anyone for their own marketing.

You can use every right listed above, the same as anyone else: to know what I hold and who receives it, and to have it corrected or deleted. Using them won’t change how I treat you. I answer within 30 days.

Do Not Track and Global Privacy Control. The site doesn’t change what it does when your browser sends these signals, because there is nothing to switch off: it runs no analytics, ads, or cross-site tracking, and nothing is sold or shared. I don’t let any third party collect information about your browsing across other sites through this site.

Security and breaches

Everything travels over HTTPS. Requests between the site and its back end are signed, so only the site can submit them. Logs leave out names, email addresses, and messages. The site never asks for card details, so please don’t send them through the form or by email; invoices are paid on the payment provider’s own page. If a breach puts your data at risk, I’ll tell the relevant authority and you as the law requires; under the GDPR, the authority hears within 72 hours.

Children

This site isn’t meant for anyone under 16. If you’re under 16, please don’t send a message or subscribe. If a child’s data reached me anyway, tell me and I’ll delete it.

Changes

When this notice changes, the date at the top changes with it. Big changes that affect subscribers go out by email first.