Privacy policy

This policy explains what personal data amanjain.codes collects, why, who processes it, how long it is kept, and how to ask me to delete it.

Who is responsible

Aman Jain, an individual (sole proprietor) based in Bengaluru, Karnataka, India, is the data controller for the personal data described here. For anything about your data, email kits@amanjain.codes or use the contact form.

What I collect and why

Contact form

• What: the reason you picked, your name, your email address or phone number, your company or a link if you add one, and your message.
• Why: to reply to you. The legal basis is your request to be contacted.
• Who processes it: Formspree, the form service that receives the message and emails it to me.
• How long: up to 24 months after our last exchange, then deleted.

Newsletter

• What: your email address, the page you signed up on, and when.
• Why: to email you when a new post goes up. The legal basis is your consent.
• Who processes it: Upstash, the database behind the site.
• How long: until you ask to be removed.

Comments and likes

• What: for a comment, your name, your email address (never shown on the site), your comment, the passage it refers to and when you posted it. Your name and comment are public once approved. For a like, a random ID stored in your browser; no name or email.
• Why: to moderate and show comments, to contact you about your comment if needed, and to count likes. The legal basis is your consent when you post, and my legitimate interest in keeping the comments free of spam.
• Who processes it: Upstash stores comments and likes; Formspree may email me a copy of a new comment for moderation.
• How long: while the post is online, or until you ask me to delete your comment.

Notify-me list for kits

• What: your email address, the kit you are waiting for, and when you signed up.
• Why: to send you one email when that kit opens. The legal basis is your consent.
• Who processes it: Upstash.
• How long: deleted once the kit opens and I have sent that email, or after 12 months, whichever comes first. You can ask to be removed earlier.

Purchases

• What: Paddle.com is the Merchant of Record for all kit orders. Paddle collects your payment details, billing country and the details it needs for tax and invoices; your card details go to Paddle and never reach me. From Paddle I receive your email address, your name if you give one, your country, the kit you bought, the amount and currency, the order number and any refund or chargeback.
• Why: to deliver the kit, give you access, handle refunds and keep accounting records. The legal basis is our contract, and my legal obligation to keep tax records.
• Who processes it: Paddle, under Paddle’s privacy policy for the data it collects as Merchant of Record; Supabase stores my copy of the order.
• How long: as long as tax and accounting law requires, then deleted.

Accounts and downloads

• What: your email address, the kits you own and their versions, your sign-ins, and a log of your downloads (which kit and when).
• Why: to let you sign in with an emailed link, download what you bought, send you purchase emails, and notice abuse such as shared accounts. The legal basis is our contract, and my legitimate interest in preventing misuse.
• Who processes it: Supabase (accounts, orders and private file storage) and Resend (sending sign-in links and purchase emails).
• How long: your account and orders while you have access to a kit, and as long as accounting law requires after that; download logs for 12 months.

Analytics

• What: the pages you visit, actions such as button clicks and form submissions (not what you type), the page you came from, your device and browser type, and your approximate location derived from your IP address.
• Why: to understand which pages are useful and fix what is not. The legal basis is your consent for Google Analytics cookies where the law requires it (see Cookies), and otherwise my legitimate interest in running the site.
• Who processes it: Google Analytics 4 and Vercel Web Analytics. Analytics runs only on amanjain.codes, not on preview copies of the site.
• How long: Google Analytics keeps event data for up to 14 months; Vercel keeps aggregated visit data according to its own policy.

Hosting and security

Vercel hosts the site and processes your IP address and standard request logs to serve pages and protect the site. To limit abuse, the site’s forms store a one-way hash of your IP address, never the address itself, for at most one hour.

Stored in your browser

The site saves some settings in your browser’s storage: your theme, text size and animation preference, your cookie choice, the currency you chose for kit prices, where you stopped reading, your highlights, the posts you have read, and the random ID used for likes. These stay on your device and are not sent to me, apart from the likes ID when you like a post. You can clear them at any time in your browser settings.

Cookies

Google Analytics sets cookies to tell visits apart. The site uses Google’s Consent Mode:

• If you visit from the European Economic Area, the UK or Switzerland, Google Analytics cookies are off until you accept them. If your browser is set to a European time zone, a small banner asks you to accept or decline.
• Elsewhere, Google Analytics cookies are on by default.
• Wherever you are, “Cookie settings” in the footer of every page lets you accept or decline, and you can change your mind at any time. Declining removes the Google Analytics cookies from your browser.

Your choice is saved in your browser’s storage so the banner does not keep coming back. The site runs no ads and sets no advertising cookies, and the advertising signals in Consent Mode are always off.

Vercel Web Analytics does not use cookies, so it keeps counting visits whatever you choose. You can also block or delete cookies in your browser settings.

Who receives your data

Recipient	What for
Vercel	Hosting, request logs and web analytics
Upstash	Database for the newsletter, comments, likes and notify-me list
Formspree	Contact form messages and comment notifications
Google Analytics	Analytics
Paddle.com	Payments, taxes and invoices as Merchant of Record
Supabase	Accounts, orders and private file storage
Resend	Sign-in links and purchase emails

I may also share data with professional advisers, such as an accountant, and with authorities where the law requires it. I do not sell your personal data.

These providers may process data outside your country, including in the United States. They protect it with safeguards such as standard contractual clauses.

Your rights

Depending on where you live, you can ask me to show you the personal data I hold about you, correct it, delete it, restrict or object to how I use it, or give you a copy in a portable format. Where I rely on your consent, you can withdraw it at any time. You can also complain to your data protection authority.

To make a request, including a request to delete your data, email kits@amanjain.codes from the address you used on the site. I will reply within one month.

Security

The site is served only over HTTPS. Kit files are kept in private storage and are only reachable through download links that expire after 10 minutes. Access to stored data is limited to me, and keys to the services above are kept out of the site’s code.

Changes to this policy

When this policy changes, I will update the date at the top of the page.