Legal

Privacy policy

Last updated: 30 September 2026

Last updated: October 2026. This notice describes all personal data processing on this website (the "Service"), operated solely by Safayet Hossain Masum ("I", "me", "my"). Written for GDPR / UK GDPR. It is not legal advice.

1. Controller

Safayet Hossain Masum, Munich, Germany.
Email: safayet@safayetmasum.com
See the imprint for additional operator details.

2. Personal data we collect and why

2a. User accounts (sign up & authentication)

  • Data: Full name, unique username, email address, email verification status, account creation timestamp.
  • Password accounts: Your password is never stored in plain text. It is hashed using PBKDF2-SHA256 with 100,000 iterations and a unique cryptographic salt (Web Crypto standard). The hash is one-way — not reversible.
  • Google OAuth accounts: If you sign in with Google, we receive your Google account ID, email address, display name, and email verification status from Google. We do not receive or store your Google password. Google's own privacy policy applies to the data Google collects.
  • Mixed accounts: If you link a Google account to an existing email/password account, we store both your Google ID and your password hash.
  • Legal basis: Art. 6(1)(b) GDPR — performance of a contract / steps taken at your request to create and maintain your account.

2b. Email verification

  • Data: A cryptographically random, time-limited verification token (64 hex characters) linked to your account.
  • Purpose: Confirming you own the email address before granting full account access. Tokens expire after 24 hours and are deleted on use.
  • Legal basis: Art. 6(1)(b) GDPR — contract performance and security obligations.

2c. Password reset

  • Data: A cryptographically random, single-use reset token (64 hex characters) linked to your account, valid for 1 hour.
  • Purpose: Allowing you to regain access to your account securely. Tokens are invalidated immediately on use.
  • Legal basis: Art. 6(1)(b) GDPR — contract performance / account security.

2d. Session cookies

  • User session (sm_user_session): An HMAC-signed, HttpOnly, Secure, SameSite=Lax first-party cookie set when you log in. It identifies your session server-side. Valid for 7 days, or until you log out. No personal data is stored in the cookie value itself — only a signed session reference.
  • Admin session (sm_admin): A separate HttpOnly session cookie, set only after a successful admin login. Valid for 8 hours.
  • Consent preference (sm_consent): Stores your cookie banner choices. Valid for 180 days.
  • Legal basis: Art. 6(1)(b) / (f) GDPR — necessary for service provision and legitimate interests in security.

2e. Contact form

  • Data: Name, email address, subject, message body, and submission timestamp — only when you submit a message and explicitly confirm consent.
  • Processing: Messages are stored securely in our visitor store and forwarded via transactional email directly to safayet@safayetmasum.com to enable prompt response.
  • Legal basis: Art. 6(1)(a) GDPR — your freely given consent; and Art. 6(1)(b) — pre-contractual steps at your request.

2f. Live visitor telemetry (optional, consent-gated)

  • Data: A random session UUID (stored in sessionStorage, not cookies), coarse geographic location (city, region, country, coordinates), ISP label, and a truncated SHA-256 hash of your IP address — only if you opt in via the cookie banner.
  • Purpose: Populating the real-time globe visualisation visible on the homepage. Visible to site admin in a private dashboard.
  • Legal basis: Art. 6(1)(a) GDPR — your explicit consent. You may withdraw at any time via Cookie Settings.

2g. Hosting and infrastructure logs

  • Data: IP address, User-Agent header, requested URLs, and timestamps. Processed by Cloudflare as the infrastructure provider for routing, DDoS protection, and edge delivery.
  • Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in maintaining secure and performant services.

2h. Third-party fonts

  • Webfonts may be served from Google Fonts CDN, which receives your IP address. You may block this via a browser content blocker without affecting account functionality.

3. Recipients and international transfers

We use the following processors:

  • Cloudflare, Inc. / Cloudflare, Ltd. — hosting, edge delivery, KV storage. Data may be processed in the EU, UK, and other regions under Cloudflare's Data Processing Addendum and Standard Contractual Clauses.
  • Google LLC — Google OAuth 2.0 authentication (if you choose to sign in with Google) and Google Fonts CDN. Subject to Google's Privacy Policy and their EU SCCs. Google OAuth data is fetched at sign-in time and is not further shared with Google by us.
  • Resend / SendGrid (if configured) — transactional email delivery for email verification, password-reset links, and forwarding contact messages. Data is limited to recipient/sender email addresses and the message content.

We do not sell, rent, or trade personal data to any third party.

4. Retention

  • User account data: retained while your account is active or until you request erasure. Passwords are irreversibly hashed and cannot be recovered.
  • Email verification tokens: 24 hours maximum; deleted on successful verification.
  • Password reset tokens: 1 hour maximum; deleted on successful password change.
  • User sessions: 7 days, or immediately on logout.
  • Admin sessions: 8 hours.
  • Consent preferences: up to 180 days, after which you will be prompted again.
  • Live presence data: approximately 45 seconds after the last heartbeat.
  • Historical visit records (admin): capped at 800 records; oldest records are automatically dropped.
  • Contact messages: retained until handled, then deleted; capped at 200 records.
  • Infrastructure logs: as determined by Cloudflare's own retention policy (typically up to 30 days).

5. Security measures

  • Passwords hashed with PBKDF2-SHA256, 100,000 iterations, unique random salt per account (Web Crypto API).
  • Session tokens are HMAC-SHA256 signed and verified on every request.
  • All authentication cookies are HttpOnly (inaccessible to JavaScript), Secure (HTTPS-only), and SameSite=Lax (CSRF protection).
  • OAuth state parameters are HMAC-signed to prevent CSRF attacks during Google sign-in flows.
  • All verification and reset tokens are 64-character cryptographically random hex strings (256 bits of entropy).
  • Rate limiting is applied to login, signup, email verification, and password reset endpoints to prevent brute-force attacks.
  • All API responses that handle user data include Cache-Control: no-store to prevent caching of sensitive responses.
  • Transport security is provided by Cloudflare TLS (HTTPS enforced at the edge).

6. Your rights (GDPR)

As a data subject in the EU/EEA/UK, you have the right to:

  • Access — obtain a copy of the personal data we hold about you.
  • Rectification — correct inaccurate data.
  • Erasure ("right to be forgotten") — request deletion of your account and associated data.
  • Restriction — ask us to restrict processing in certain circumstances.
  • Portability — receive your data in a structured, machine-readable format.
  • Object — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent (e.g., telemetry), withdraw at any time without affecting past lawful processing.
  • Lodge a complaint — with a supervisory authority. If you are in Bavaria, Germany: the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). If you are in the UK: the Information Commissioner's Office (ICO).

To exercise any right, or to request account deletion, email safayet@safayetmasum.com. We will respond within 30 days.

7. Children

The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data, please contact us and we will delete it promptly.

8. Changes to this policy

We will update the "Last updated" date at the top of this page when material changes are made. For significant changes affecting your rights, we will display a notice on the site. Continued use of the Service after changes constitutes acceptance of the updated policy.

9. Contact

For privacy queries or to exercise data subject rights: safayet@safayetmasum.com