Privacy policy
This policy explains what personal data hadihz.me collects, why, and what you can do about it.
The short version: there are no ads, no tracking cookies, and nothing is sold. Personal data is collected only when you create an account, submit a testimonial, or write to me through the contact form.
Who is responsible
Hadi Hijazi, Beirut, Lebanon, is the controller of the personal data processed through hadihz.me and the API it uses at cms.hadihz.me.
For anything about your data, write to privacy@hadihz.me.
What is collected, and why
When you visit the site
Analytics. Page views are counted with Umami Cloud, a privacy-focused analytics service that sets no cookies. For each page view it records:
- the page address, without its query string
- the referring site
- the browser, operating system and device type
- the screen size and language
- the country, derived from your IP address
I do not receive your IP address, and the data is used only to understand which pages people read. If your browser sends a Do Not Track signal, nothing is recorded.
The legal basis is my legitimate interest in knowing how the site is used (GDPR Art. 6(1)(f)).
Delivery and security. Pages are delivered by Amazon CloudFront. Forms, sign-in and the "am I signed in?" check go to the CMS server. Both receive your IP address and browser user agent, because that is how the internet works.
The CMS server's request log does not record IP addresses. Rate limiting holds your IP address in memory for at most 24 hours to stop spam and brute-force attempts.
The legal basis is my legitimate interest in delivering and protecting the site (Art. 6(1)(f)).
When you create an account
| Data | Details |
|---|---|
| Email and password | Your email address and your password, which is stored only as a one-way hash. Your username is your email address. |
| GitHub sign-in | Your GitHub username and verified email address. The access token GitHub issues is used once during sign-in and is not kept. |
| Sessions | For each device you sign in on: a session identifier, a device name derived from your browser's user agent, and the sign-in and expiry times. No IP address is stored. |
Accounts let you sign in today, and will let you like and comment once those features exist.
The legal basis is the performance of our agreement under the terms of use (Art. 6(1)(b)). Your account is kept until you ask me to delete it. Sessions end after 14 days of inactivity, and after 30 days at the latest.
When you submit a testimonial
The form collects:
- your name, email address and testimonial
- optionally, your role, company and a profile link
- the language you wrote in
- the time you gave consent
Your email address is never published. It is used to confirm the testimonial is really yours and to contact you about it. You also receive an automatic confirmation email.
Every testimonial is reviewed before it is published. Once published, your name, role, company, testimonial and profile link appear on the site, translated into its other languages (English, French, German and Arabic). Translation may be assisted by an AI service.
The legal basis is your consent (Art. 6(1)(a)), given with the checkbox on the form. You can withdraw it at any time by emailing privacy@hadihz.me, and the testimonial is removed with the next update of the site.
Retention:
- A published testimonial is kept until you withdraw your consent.
- A submission that is not published is deleted within 12 months.
When you use the contact form
The form collects your name, email address, subject, message and the language you wrote in. They are used only to answer you, and you receive an automatic copy of your message.
The legal basis is my legitimate interest in replying to messages, or steps you asked for before an agreement (Art. 6(1)(b) and (f)). Messages are deleted within 24 months of our last exchange.
Cookies and browser storage
The site uses no advertising or analytics cookies. Everything below is strictly necessary for a feature you use, so no consent banner is needed. Your language is part of the address, not a cookie.
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
strapi_up_refresh |
Cookie on cms.hadihz.me | Keeps you signed in | Until you close the browser; the session itself ends as described above |
hadihz_github_oauth_state |
Cookie on cms.hadihz.me | Protects GitHub sign-in against forged requests | 10 minutes |
hadihz:session |
Session storage on hadihz.me | Remembers for 5 minutes whether you are signed in | Until you close the tab |
hadihz:search-recents |
Local storage on hadihz.me | The last three search results you opened; it never leaves your device | Until you clear it |
Service providers
These providers process data on my behalf, only for the purposes above:
| Provider | Role | Location |
|---|---|---|
| Amazon Web Services (CloudFront, S3) | Hosts and delivers the site and its images | Images stored in the EU (Frankfurt); pages served from the edge location nearest to you |
| netcup GmbH | Runs the server behind cms.hadihz.me | Germany |
| Neon | Hosts the database | EU (Frankfurt) |
| Resend | Sends account, testimonial and contact emails | United States |
| Umami Cloud | Website analytics | See Umami's privacy policy |
| GitHub | Sign-in, only if you choose "Continue with GitHub" | United States |
| OpenRouter | AI-assisted translation of published testimonials | United States |
Where a provider processes data outside the EU or EEA, the transfer relies on the provider's safeguards, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Your data is never sold, never used for advertising, and never used for automated decisions about you.
Your rights
You can ask me to:
- give you a copy of your data, including in a portable format
- correct it
- delete it
- restrict its use
- stop using it where the legal basis is legitimate interest
You can also withdraw your consent at any time. There is no self-service account deletion yet, so email privacy@hadihz.me and I will reply within one month.
If you live in the EU or EEA, you can complain to the data protection authority where you live or work. Lebanon's Law No. 81 of 2018 on electronic transactions and personal data also applies to this processing.
Children
The site is not aimed at children. Do not create an account or submit a testimonial if you are under 16.
Security
- All traffic is encrypted with HTTPS.
- Passwords are stored only as hashes.
- The access token that proves you are signed in lives only in your browser's memory, never in storage.
- The sign-in cookie cannot be read by scripts.
Changes to this policy
When this policy changes, the date at the top changes with it. If a change affects how your account data is used, account holders will be told by email before it takes effect.