Privacy policy
Effective 7 September 2026
This site collects very little. This page sets out exactly what, why, who else touches it, how long it stays, and what you can ask of me.
01Who is responsible
furqankhan.me is the personal website of Furqan Khan, an individual. For the purposes of data-protection law, Furqan Khan is the controller of any personal data described here. Requests and questions go through the contact form on the home page.
02Scope
This policy covers furqankhan.me and its pages, including the case studies under /work. It does not cover other sites or services I run or am involved with, such as itminan.co, thekleos.co, nayyer.coach or audela.me. Each of those has its own policy.
03What is collected
Notes you send through the contact form
The form asks for your name, your email address and your note. On some case pages the form also records which page you wrote from, so I know what you are asking about. Nothing else on the form is required or collected. The form contains a hidden field that only automated scripts fill in; a submission with that field filled is discarded and never sent.
Technical data when a page is served
Like any website, this one is served by servers that receive your IP address, browser type and version, the page requested, the referring page and the time of the request. The hosting provider keeps this in short-lived operational logs. The contact endpoint also holds the IP address of recent submissions in memory for ten minutes, so that a single source cannot flood the form. That record is not written to disk.
Aggregated visit statistics
The site uses Vercel Web Analytics to count page views and visitors. It sets no cookies and does not track you across sites. It derives a temporary visitor identifier from a hash of your IP address and browser that is discarded daily, so I see page counts, countries and device types in aggregate, never an individual.
What is not collected
- No accounts, logins or passwords.
- No database of visitors or of notes sent.
- No advertising, retargeting or cross-site tracking.
- No cookies set by the site itself.
04Why, and on what basis
| Data | Purpose | Basis |
|---|---|---|
| Name, email, note | To read your note and reply to it | Steps taken at your request before any agreement; my legitimate interest in answering correspondence |
| IP address and request logs | To serve the site securely and stop abuse | Legitimate interest in security and availability |
| Aggregated visit statistics | To see which pages are read and on which devices | Legitimate interest in understanding how the site is used, by a method that does not identify you |
05Who processes it for me
I do not sell personal data, and I do not share it with anyone for their own purposes. The following providers handle data on my behalf, under their own terms and security commitments:
- Vercel Inc. hosts the site, serves the pages, and provides the aggregated analytics described above. Vercel processes request data on servers that may be located outside your country, including in the United States.
- Resend Inc. delivers contact-form notes to my mailbox as email. Resend keeps delivery logs for a limited period under its own retention policy.
- Google Workspace holds the mailbox where notes arrive and where my replies are written.
- Fontshare, run by the Indian Type Foundry, serves the site’s typeface. Your browser requests the font files from Fontshare’s servers, which receive your IP address to fulfil that request.
06Embedded films and social posts
Some films and posts on this site are played inside the site through embedded players from YouTube, TikTok, Instagram and Facebook. Nothing from those services loads until you choose to open a film or post. When you do, your browser connects to that provider, which may set its own cookies and collect data under its own privacy policy. YouTube embeds use the privacy-enhanced youtube-nocookie domain. Films that I host myself are served from this site and involve no third party.
07Links to other sites
The site links to LinkedIn, TikTok, Instagram, Facebook, X, WhatsApp and to sites I have built for others. Once you leave furqankhan.me, that site’s policy applies, not this one.
08How long it is kept
- Notes sent through the form stay in my mailbox for as long as the conversation is live and for a reasonable period after, so I can pick it up again if you write back. Ask, and I will delete them.
- Hosting logs are kept by Vercel for a short operational window and then discarded.
- The in-memory rate-limit record expires after ten minutes.
- Analytics are stored only in aggregate and cannot be traced back to you.
09International transfers
I work from Pakistan and the Gulf, and the providers above run infrastructure in the United States and elsewhere. If you are in the European Economic Area, the United Kingdom or another jurisdiction with transfer rules, your data may leave that jurisdiction when it is processed by those providers. They rely on standard contractual clauses or equivalent safeguards for such transfers.
10Your rights
Depending on where you live, you may have the right to ask what personal data I hold about you, to have it corrected or deleted, to object to or restrict its processing, to receive a copy in a portable form, and to complain to a supervisory authority. I honour these requests regardless of where you live. Write through the contact form, tell me which email address you used, and I will act within thirty days. I may ask you to confirm that the address is yours before releasing anything.
11Security
The site is served over HTTPS only, with security headers that restrict which sources a page may load from. Notes travel from your browser to my mailbox over encrypted connections. No method of transmission or storage is perfectly secure, but I keep the surface small: no database, no accounts, no stored payment details.
12Children
This site is not directed at children under sixteen, and I do not knowingly collect personal data from them. If you believe a child has sent me a note, tell me and I will delete it.
13Changes to this policy
If the way the site handles data changes, this page changes with it, and the date at the top moves. Material changes, such as adding a new provider or a new kind of collection, will be described here in plain words rather than buried.
14Contact
Use the contact form on the home page for anything to do with this policy or your data.