Privacy

Who is responsible

I am, as the data controller: Ahmad Khan, an independent developer based in Mumbai, India. You can reach me about anything on this page at ahmad@khanahmad.com.

What is collected

If you send a message, the form collects your name, your email address, your company if you give one, and whatever you write. That is all it asks for, and it is used for one thing: replying to you.

To keep the form free of spam, it uses Cloudflare Turnstile. When you submit, Turnstile checks that a person rather than a script is sending, which involves your IP address and signals from your browser. It runs in its own frame, sets no cookies on this site, and is only loaded on the page that has the form.

To serve the pages at all, the host — Cloudflare — necessarily handles your IP address, the page you asked for, your browser’s user agent and the address of the page that linked you here. That is how any website works; it is not used to identify you.

To count page views, the site uses Cloudflare Web Analytics. A small script from Cloudflare reports the page you are on, how you reached it — a new visit, a reload, a link within the site — your type of browser, the site that linked you where your browser shares it, and how quickly the page loaded. It uses no cookies and no identifier that lasts beyond the page you are looking at, so it cannot recognise you on a later visit.

To see how the site is found, the server also keeps a count of visits that arrive from AI assistants such as ChatGPT or Perplexity, and of visits from search and AI crawlers — which never run the script above, so it cannot see them. Each record holds the referring site’s name, the page and the date. It never holds your IP address or anything else that points back to you.

What is not collected

• No cookies, of any kind — which is why there is no cookie banner.
• No local storage, session storage or anything else written to your browser.
• No analytics that identify you or recognise you on a later visit, and no advertising or tracking pixels.
• No fonts or images fetched from other companies. Everything this site shows is served from this domain, so loading a page does not tell Google, GitHub or anyone else that you visited. The one script that comes from elsewhere is Cloudflare’s, for the page-view counts above — and Cloudflare is already the host.

Why, and on what basis

Under the GDPR, every use of personal data needs a legal basis. These are mine:

• Replying to your message — taking steps you have asked for before we might work together (Article 6(1)(b)), or my legitimate interest in answering people who get in touch (Article 6(1)(f)).
• The spam check — my legitimate interest in keeping the form usable, and yours in not being impersonated through it (Article 6(1)(f)).
• Serving the site and counting how it is found — my legitimate interest in running a website and knowing whether anyone reaches it (Article 6(1)(f)), using no data that identifies you.

Nothing here involves automated decisions about you, and nothing is sold or shared for marketing.

Who else handles it

Two companies process data for me, only to provide their service:

• Cloudflare, Inc. hosts the site, runs the spam check, provides the page-view counts, and forwards mail sent to my address.
• Resend delivers the email your message becomes, from the form to my inbox.

Neither is allowed to use your data for its own purposes. Links on this site to GitHub, LinkedIn, npm or Upwork are ordinary links — nothing is sent to those sites unless you click one, and once you do, their own privacy policies apply.

Where it goes

Both providers are based in the United States and run infrastructure worldwide, so your data may be processed outside the European Economic Area. Where that happens it is under the safeguards the provider offers for international transfers, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long it is kept

The site itself stores nothing from the form — your message is sent as an email and lives only in my inbox. I keep it for as long as the conversation, and any work that follows from it, is going on. After that I delete it, unless there is a legal reason to keep it, such as an invoice.

Ask me to delete it sooner and I will. The visit counts described above hold nothing that identifies you, so they are kept as ordinary statistics.

What you can ask for

You can ask me, at any time and at no cost, to:

• tell you what I hold about you, and give you a copy
• correct anything that is wrong
• delete it
• stop or limit how I use it, or object to a use based on legitimate interest
• give it to you in a form you can take elsewhere

Write to ahmad@khanahmad.com. I will reply within a month, and usually much sooner. If you are not happy with the answer, you can complain to the data protection authority where you live or work — in the Netherlands the Autoriteit Persoonsgegevens, in Germany your state’s data protection authority, in France the CNIL, in the UK the ICO.

Changes to this page

If what this site collects changes, this page changes first, and the date at the top moves with it.