Privacy Policy

Rufsan Shares is operated by Rufsan Hossain as an individual, from Bangladesh. There is no company behind it and no staff — when this policy says “I”, it means one person.

Only these, and only for the reason listed:

• Account details — your email, display name, and an avatar if you set one. Needed to sign you in and to attribute your comments. If you sign in with Google or GitHub, that provider tells this site your email, name and avatar; it doesn't hand over anything else, and your password is never seen by this site at all.
• Things you write — comments, and any profile bio or links you add. These are public by design.
• Things you press — likes, upvotes, bookmarks, and which posts you've read. Bookmarks and read history are private to you; like and upvote counts are public in aggregate.
• Newsletter subscription — your email address and when you confirmed, if you signed up. Nothing else.
• Sign-in sessions — each one records the IP address and browser you signed in from, so a session you don't recognise can be spotted and ended. Deleting your account deletes these.
• Searches — what was typed into the search box, the number of results, and which result was clicked. Linked to your account if you were signed in, so that it can be told apart from the same search by someone else.
• Page views — counted per post, deduplicated per visitor per day. See the next section, because how this is done matters.

Three places store it, and nowhere else. Each one is listed because a policy that said “we may collect IP addresses” would tell you less than the code already does:

• Your sign-in sessions — stored with the session so you can recognise your own, and deleted when the session or your account is.
• Newsletter sign-ups — recorded once, with the timestamp, as the record that consent was given. This is the evidence that you asked to be emailed; it is kept for as long as the subscription is.
• Administrative actions — if an admin bans an account, changes a role or deletes something, the log of that action records the admin's IP address. This is about accountability for administrators, not about readers.

Rate limiting also holds your IP address briefly — in a counter that expires within minutes, kept by Upstash, so that the sign-in and comment forms can't be hammered.

And while you are signed in, a copy of it sits in your own browser: the session-cache cookie carries the session record, IP address included. The Cookie Policy lists what that cookie holds, field by field.

And one place it goes without being kept. Profile pictures from a Google or GitHub sign-in are still stored at that provider, so your browser fetches them directly and the provider sees your IP address — on any page showing such a person, whether or not you have an account here. Nothing about it is recorded by this site. The request is sent without a referrer, so the provider is not told which page you were reading. It is the one company your browser contacts that isn't listed above as running part of this site — the section below explains why that distinction is the whole point.

Post views are the deliberate exception. To count a view once rather than once per refresh, the site needs to recognise a repeat visitor for 24 hours. It does that by combining your IP address and browser user-agent, hashing them with a secret key, and storing only the hash. The original is discarded in the same breath and the hash can't be reversed. The practical effect: nobody, including me, can look up which posts a given IP address read.

This site is small, but it isn't self-contained. These services process data on its behalf, and nothing is shared beyond them:

• Neon — the PostgreSQL database where everything above is stored.
• Vercel — hosting, and Vercel Analytics for aggregate traffic. Analytics is cookieless and doesn't identify individuals.
• Resend — sends the newsletter and account emails (sign-in links, password resets, confirmations). It sees the address it's delivering to.
• Sentry — error reports when something breaks. Session replay is switched off deliberately, so Sentry never records what's on your screen or what you type.
• Upstash — rate limiting, so the comment form and sign-in can't be hammered. Holds short-lived counters keyed by account or IP address, which expire on their own within minutes.

Nothing is sold, rented, or handed to advertisers, because there aren't any.

• Account and content — until you delete your account.
• Newsletter — until you unsubscribe. Unsubscribing keeps a record that you did, so you aren't re-added by mistake.
• Sign-in sessions — until they expire (seven days, or thirty if you ticked “remember me”), or until you sign out or delete your account.
• View records — the hashed visitor markers described above, which stop being useful after 24 hours.
• Searches — kept, so that what people look for and don't find can be seen. Deleting your account unlinks them from you.
• Administrative log — kept indefinitely and never edited or deleted, because it is the record of what administrators did. It is the one place a deleted account leaves a trace; see the next section.
• Error reports — kept by Sentry on their own retention schedule, typically weeks rather than years.

Wherever you live, you can get a copy of what this site holds about you, ask for it to be corrected, or delete it.

The copy doesn't need asking for. Signed in, Settings → Your data downloads the lot as a JSON file, built when you click it: your account, everything you wrote, everything you pressed, your sessions and sign-in methods, and your newsletter subscription. It leaves out your password hash, your session tokens and any Google or GitHub tokens, because those are working keys rather than records about you — and it gives who follows you as a number rather than a list, since this site shows follower lists to nobody and a download shouldn't be the one exception. The file says so itself, in a notIncluded section, rather than leaving you to notice.

What deleting your account does, precisely. The account closes immediately: you can no longer sign in, every session ends, and your profile stops resolving. For thirty days after that your name and email address are still held on the closed account — deliberately, so that if you change your mind, or the deletion wasn't you, there is something left to restore. Reply to the confirmation email within the window and I can put it back.

When the thirty days are up, the account is erased without anyone asking. The name becomes “Deleted User”, the email address is replaced with a placeholder that cannot receive anything, the avatar file is deleted from storage rather than merely unlinked, the bio and profile links are wiped, and the password and any Google or GitHub connection are removed. Your bookmarks, reading history and follows go with them. Nothing is left that says who you were.

What stays, and why. Comments you wrote stay where they are, so threads other people are reading don't collapse — after the window they show “Deleted User” instead of your name. Likes and upvotes stay as bare numbers, attached to an account that no longer identifies anybody; removing them would make public counts wrong without making you any more anonymous than deleting your name already did.

One caveat, while it is still true. The erasure above is written and tested, but the daily job that is meant to run it unattended is not scheduled yet — this site's hosting plan allows two scheduled jobs and both are already in use. Until that is sorted, the thirty-day erasure is run by hand rather than by a clock, so treat the date as a commitment I keep rather than one a machine keeps for me. I would rather say that here than let you assume otherwise.

If thirty days is too long, ask. Email me and I'll run the same erasure immediately — it is the same code, not a manual approximation of it.

One exception, stated plainly. If an administrator ever deleted your account, that entry in the administrative log keeps the name and email it had at the time. That is deliberate: a log of who deleted whom is worthless if the “whom” can be erased from it, and it is what makes the action answerable afterwards. It is not used for anything else, and nothing else survives.

If you're in the EU or UK, that's your GDPR rights of access, rectification, erasure, portability and objection. If you're in California, it's your CCPA rights of access, deletion and non-discrimination. Access and portability need no request at all — the download above is both. Correction is the profile form. For anything else, email me and I'll do it; a right you have to write a letter to use is a weaker right than one with a button, which is the whole reason those two have buttons.

Nothing to opt out of: this site does not sell or share personal information, and never has. There is no advertising network and no data broker. No page here loads a script from somebody else's server, and nothing is embedded in an iframe at all — the site's own security headers enforce both rather than merely intending them.

Your browser does send things outward, and it is worth being exact about where: page-view and speed measurements go to Vercel, and if something breaks, the error report goes to Sentry. Both are named above, both are paid to run parts of this site, and neither is given your details to use for their own ends. That is the distinction the law draws between a supplier and a buyer, and it is the honest one.

One exception, and it is a real one. If someone signed in with Google or GitHub, their profile picture is still held at that provider's address, so your browser fetches it from there when you load a page showing them. Google learns the IP address of everyone who reads that page. It is not advertising and nothing is sold, but it is your browser talking to Google because of a choice somebody else made, and you should hear it from this page rather than find it. The request now carries no indication of which site it came from, and hosting those pictures here instead is on the list.

Global Privacy Control. GPC lets your browser tell every site at once not to sell or share what it knows about you. Strictly, there is nothing here for it to stop — nothing is sold, so the instruction has no sale to cancel, and a site in this position could honour it by doing nothing at all and still be telling the truth.

This site reads the signal and switches something off anyway. If your browser sends GPC, the two measurements described above — Vercel's page-view count and its speed timings — are not loaded, so nothing about your visit leaves this site at all. You have said you don't want to be measured by the sites you visit, and that is a wider wish than the one the law makes enforceable; honouring only the enforceable part would be keeping the letter of a sentence you didn't write.

Error reports are the deliberate exception: if something breaks, the report still goes to Sentry. That is a diagnostic about software that failed rather than a measurement of you, and suppressing it would cost you the fix without buying you any privacy.

This site isn't aimed at children under 13 and doesn't knowingly collect anything from them. If you believe a child has created an account, email me and I'll remove it.

If this changes in a way that affects you, the date at the top changes, and material changes will be announced on the site. See also the Cookie Policy for the specifics of what this site stores in your browser.