Privacy Policy · Ahsan Mahmood
How data is collected, used and protected across this website and the Android app.
Introduction
This policy explains how information is collected, used, disclosed and safeguarded when you visit this website or use the Android app built from it.
If you do not agree with it, please do not use the site or the app. It may change at any time; changes are signalled by the Last updated date at the top of this page and nowhere else — there is no mailing list and you will not be notified individually.
Information collected
Analytics
Three providers run on this site, each answering a different question:
- Google Analytics 4 — anonymous usage: page views, session duration, device type, browser, and location at country or city level.
- Microsoft Clarity — anonymised session recordings: pointer movement, clicks and scrolling, used to find layouts that do not work.
- Amplitude — interaction and funnel data: which features get used and in what order.
Portfolio interaction
- Which projects are opened, and how long they are read
- Category filters and search queries used on the projects page
- Which payment methods are viewed
- Outbound clicks — GitHub, live demos, store listings
- CV and resume downloads
Errors and notifications
- Sentry — JavaScript errors, performance problems and crash reports.
- OneSignal — only if you opt in to notifications: a device push token and a device identifier, held so the updates you asked for can be delivered.
Collected automatically
IP address (anonymised), browser and version, device and operating system, pages visited and time spent, referring site, country or city, screen resolution, and interactions such as clicks and scrolls.
How the data is used
- Service improvement — understanding how the site is actually used.
- Performance — finding and fixing bugs, crashes and slow pages.
- Content — learning which projects and writing are worth keeping.
- Security — detecting abuse.
- Communication — replying to anything you send through a form.
What is not done with it: it is not sold, not used for advertising, not shared with marketers, and not used to track you across other websites.
Free accounts
Free accounts help pay for themselves. We may use content from free accounts to improve and train the features built here — the writing you put into a question, a feature request or a vote comment. This is separate from everything in the paragraph above and does not change it: nothing is sold, nothing goes to advertisers, and nothing is shared with marketers.
Content in a paid plan is not used this way without your explicit consent. You can object at any time by writing to the address at the end of this document and your account is excluded, and moving to a paid plan stops it outright. The same clause is in the Terms & Conditions under plans and payment.
File storage
Files are stored on FilesHub — profile images, project screenshots, CV and resume documents, and portfolio assets.
- Public files are served over a CDN and need no authentication.
- Files are kept for as long as they are referenced by something on the site.
AI features and voice recordings
Some features here use AI to draft text for you: a request or a message written from your own words, a reply in one of your threads, and answers about the work published on this site. Each one is a draft you check. Nothing is sent, filed or published until you press the button that does it.
Who processes it, and when
- Anthropic — the AI that writes the drafts and the answers. It receives the words you typed, or the transcript of what you said, and for a reply the thread it belongs to. It is sent only when you press a drafting or asking button, or after you stop a recording.
- Groq — speech-to-text. It receives a voice recording after you press Stop, and returns the written version of it.
Both act as processors, on instruction, and each keeps what it receives under its own API data policy: Anthropic and Groq.
What this site keeps: the draft you confirm, as the request or message you sent. Questions asked about the work are not stored — only a count of how many you asked this month, for the monthly allowance.
Voice recordings
When you use Speak, the recording is stored privately in your account and is used only to create the record you confirm. It is transcribed twice — once on your device as you speak, and once on the server from the audio — and the two versions are read together, which is why a word misheard in one usually comes out right.
- Only you can play it. Delete it at any time from Speak, under Your recordings — that removes the audio and both transcripts; anything you already sent stays.
- It is removed with your account.
- It is never published, never shown to anyone else, and never used for anything except the draft you asked for.
The microphone
The microphone is asked for only when you tap Speak, never when a page opens. It is optional: everything Speak does can also be typed, and the site and the app work fully without it.
Android app permissions
The app asks for the minimum needed for the features you choose to use, and nothing is collected without an action you started. It does not request camera, location or media-storage permissions.
Microphone
Asked the first time you tap Speak, and only then — never at launch. Declining it leaves every other feature working, and anything Speak does can be typed instead.
Picking an image
Attaching an image to a conversation or setting a profile picture opens the standard Android system file picker. No Android permission is required for this, and it only happens when you tap an upload control.
Notifications
On Android 13 and later the app asks for notification permission the first time you enable a notification, never at launch. Declining it leaves every other feature working.
Sharing and third parties
Data reaches the providers named above and no one else. Most of them are processors acting on instruction; Microsoft Clarity is the one that also acts as a controller of the session recordings it holds, which is why it is named separately in the store data-safety declaration.
Data is disclosed outside that set only where the law requires it.
Security
Traffic is encrypted in transit with TLS. Database access is governed by Postgres row-level security — public content is read-only and every write is scoped to the account that owns it. Administrative access is authenticated and limited to the site owner.
No system is perfectly secure, and this one is not claimed to be. What is claimed is that the amount held is small enough that a breach could not expose much.
Your rights
Under the GDPR and comparable laws you may ask for:
- Access — a copy of what is held about you
- Rectification — correction of anything wrong
- Erasure — deletion, covered in its own document
- Restriction — a pause on processing
- Portability — your data in a machine-readable file
- Objection — to processing based on legitimate interest
Requests go to the contact address at the end of this document and are answered within 30 days. There is no charge.
Cookies and tracking
Cookies, local storage and session storage are used for preferences and for the analytics described above. The full breakdown — every cookie, who sets it, and how to switch it off — is in the Cookie Policy.
Children
This site is not directed at children under 13 and no data is knowingly collected from them. If you believe a child has provided information here, write to the address below and it will be removed.
Retention
- Analytics — retained on each provider’s own schedule, typically 14 months.
- Error reports — 90 days.
- Messages you send — until you ask for them to be deleted.
- Voice recordings — until you delete them, or your account.
- AI usage — a count per month, for the allowance; never the words.
- Uploaded files — while something on the site still references them.
Changes to this policy
Changes are published on this page with a new Last updated date. Material changes to how data is handled will also be summarised at the top of this document rather than buried in a section.
https://aoneahsan.com/privacy-policy