Privacy Policy
This policy explains what happens to your information when you use najmulhasan.navicore.co (the “site”). It describes what the site does today, and we will update it when that changes.
Who we are
The site is operated by Najmul Hasan (also known as Shariar Ahmed), based in Dhaka, Bangladesh. For any question or request about your data, contact: hello@navicore.co.
What the site collects, and why
The site has no user accounts for visitors, shows no advertising, and we do not sell personal data. This is everything it handles:
| Data | Why | Legal basis (simple) | Who handles it | How long |
|---|---|---|---|---|
| Contact form: name, email address, subject and message, only if you send the form | To read and answer your message | You asked us to get in touch; our interest in replying | Formspree (form service). Your browser sends the form to Formspree directly. | Until your message is dealt with, then deleted when no longer needed. Ask us for earlier deletion any time. Formspree also keeps submissions under its own settings. |
| Page views and performance: which pages are visited and how fast they load | To understand visits and keep the site fast | Our interest in running a working site | Vercel (Web Analytics and Speed Insights) | Under Vercel’s own retention rules |
| Standard request data: IP address, browser type, pages requested, time | To deliver the site and keep it secure | Our interest in a safe, working site | Vercel (hosting) | Under Vercel’s own retention rules |
| Fonts, icons and images from other hosts: your browser asks Google Fonts (fonts.googleapis.com, fonts.gstatic.com), Font Awesome on cdnjs.cloudflare.com (Cloudflare) and res.cloudinary.com (Cloudinary, the profile photo) for files | To display the site | Our interest in showing the site properly | Google, Cloudflare, Cloudinary. They see your IP address and browser details, as in any web request. | Under each company’s own policy |
| Admin sign-in attempts: only if someone sends a request to the private admin login. Your IP address is counted so repeated guessing can be blocked. | Security | Our interest in protecting the admin area | Upstash (Redis database), when this protection is switched on | The counter expires automatically after 10 minutes |
Under laws such as the EU and UK GDPR you may have rights to access, correct, delete or object to the use of your data. To use them, email hello@navicore.co. Data held by the companies above may also need to be requested from them; we will help where we can.
Cookies
The site’s own code sets one cookie, and only for the site owner:
- Name:
adm_session - Purpose: keeps the owner signed in to the private admin area. It is only set after the correct admin password is entered. Visitors never receive it.
- Settings: HttpOnly (not readable by page scripts), SameSite=Strict, and Secure (HTTPS only) on the live site
- Lifetime: 12 hours
- Contents: an expiry time and a cryptographic signature. No personal data.
The site’s code sets no advertising or tracking cookies and does not use localStorage or sessionStorage. The third-party services listed above handle your requests under their own policies.
Google API services (Blogger)
The site’s private admin tool can publish a short Bangla summary of an article, with a link to the original, to the site owner’s own Blogger blog. It uses the Google Blogger API with OAuth and this scope: https://www.googleapis.com/auth/blogger.
- Only the site owner’s own Google account is connected. Visitors are never asked to sign in with Google, and the site has no Google sign-in for visitors.
- It runs only when the signed-in owner chooses to publish, and only to create a post that the owner wrote (title, summary text, link and labels).
- The OAuth credentials (client ID, client secret and refresh token) are stored as private server settings at the hosting provider. They are not in the public code and are never shown to visitors.
- The site does not collect, store or share any other user’s Google data. The only item kept from Google’s response is the web address of the post that was created, saved in that article’s file in the site’s code repository on GitHub.
- We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.
The use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Other owner-only integrations
The same admin tool uses the owner’s own accounts to save article files to GitHub, cross-post articles to dev.to and Hashnode, and tell search engines about new pages through IndexNow. These requests carry content the owner has written for publication (article text, titles and links). They do not carry visitor data.
International transfers
The companies named above may process data outside Bangladesh, including in the United States and other countries where they operate. By using the site or sending a message you understand your data may be handled there under those companies’ terms.
Children
The site is not aimed at children, and we do not knowingly collect personal data from children under 13. If you believe a child has sent us a message, email hello@navicore.co and we will delete it.
Changes to this policy
If the site’s behaviour changes, we will update this page and the “Last updated” date above. Please check back from time to time.
Contact
Najmul Hasan, Dhaka, Bangladesh. Email: hello@navicore.co.