Privacy Policy

Who is responsible

Qausar Rhaman operates qausarrahman.com and decides how the data described here is used. For any question or request about your data, email qrhaman@gmail.com.

What is collected

Everyone who visits

Every page view records the page path, the referring site's domain, and your browser, device type and operating system. A random identifier is stored in a cookie for a year so repeat visits can be counted as one visitor rather than many.

Your IP address is never stored. It is combined with a secret and run through a one-way SHA-256 hash, and only that hash is saved. It cannot be reversed back into your address. The hash exists to tell two visitors apart, nothing else.

There is no Google Analytics, no advertising network, no third-party tracking script and no cross-site profiling. The statistics are stored on this site's own server and are seen only by the site owner.

If you contact or subscribe

• Contact form: your name, email address and message.
• Newsletter: your email address, plus a record of which emails were sent to you.
• Booking a meeting: your name, email address, the topic and any notes you add.

If you create an account

• Your name and email address.
• Your password, stored only as a bcrypt hash — the site never holds the password itself.
• If you sign in with Google or GitHub: the account identifier, email, name and profile picture those services return.
• Course progress, notes and comments; quiz answers and scores; any project boards, tasks and files you create.
• A record of your active sessions — device, browser and approximate time — so you can review and revoke them.

If you use the chat assistant

The messages you type are sent to Google's Gemini API to generate a reply, along with information about this site's content. Do not put anything confidential into it.

Google user data

If you are the site owner, connecting a Google account grants this site access to Google Calendar in order to create, read and delete the calendar events that correspond to bookings made on this site. That access is used for that purpose only.

The site stores a Google refresh token, encrypted, and the email address of the connected account. It does not read your wider calendar contents beyond the free/busy information needed to offer available time slots, and it does not transfer Google user data to anyone else, use it for advertising, or allow humans to read it except as needed to fix a fault you have reported.

This site's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Access can be revoked at any time from your Google account permissions, which immediately stops this site from reaching the calendar.

Cookies

None of these are advertising cookies, and none are shared with another party.

Who else sees your data

Data is never sold. It reaches these services only where the feature requires it:

• The web host — stores the site and its database.
• The email provider — delivers confirmations, newsletters and replies.
• Google Calendar — receives a booking's name, email, time and topic when you book a meeting.
• Google Gemini — receives your chat assistant messages.
• Google and GitHub — only if you choose to sign in with them.
• YouTube — embedded videos are loaded from Google, which may set its own cookies. Their privacy policy governs that.

Data may also be disclosed where the law requires it.

How long it is kept

• Analytics: indefinitely, in the hashed form described above.
• Contact messages and bookings: until no longer needed, then deleted.
• Newsletter: until you unsubscribe, using the link in any email.
• Accounts: until you ask for deletion.

Your rights

You can ask for a copy of your data, ask for it to be corrected or deleted, withdraw consent, or object to its use. Email qrhaman@gmail.com and you will get a reply within 30 days. Signed-in users can edit their profile and revoke sessions directly from the dashboard; newsletter emails carry a one-click unsubscribe link.

Security

The site is served over HTTPS. Passwords are stored as bcrypt hashes and secrets such as the Google refresh token are encrypted at rest. Sessions are signed and expire. No system is perfectly secure, but data is kept to the minimum the features need.

Children

This site is not aimed at children under 13 and does not knowingly collect their data. If you believe a child has provided information here, email me and it will be removed.

Changes

Any change to this policy will be published on this page with a new date at the top. Material changes affecting account holders will also be sent by email.

See also the Terms of Service.