Privacy

The short version

• No advertising, no third party trackers, no tracking cookies, and nothing is sold.
• The site counts visits itself, anonymously, and does not count you at all if your browser asks not to be tracked.
• If you write to me, subscribe, or save a score in SHIFT, the site keeps what you send, only for that purpose.
• You can ask what is held about you, and have it corrected or deleted, by emailing za@jhu.edu.

Who is responsible

This website, zohaibakhtar.com, is run by Zohaib Akhtar as an individual. I am responsible for the information described here (in the language of European law, the "controller"). For anything about your information, email za@jhu.edu.

This site is personal. It is not run by Chroneme, OpenCura, Johns Hopkins, or any other organization, and they do not receive information from it, except as described under Subscriptions for readers who choose Chroneme updates.

What happens when you simply read

Visit statistics

To learn which pages are read, the site counts visits itself, on its own server, without cookies and without any third party service.

For each page view it records: the page and its title, the website you came from (only its domain, such as linkedin.com), any campaign tags in the link, your device type, browser and operating system (worked out from your browser, which is not stored), the language your browser prefers, whether you have visited before, and your approximate location (country, region and city) and the organization that runs your network (for example a university, hospital or company).

On essays and case studies it also records how far you read, in steps of a quarter, and for how long. It notes when you press Listen, when you follow a link to another website (only that site's name), and when you subscribe, send a message, or add the site to your phone.

You are counted with an anonymous code, made by scrambling the date, your network address and your browser details together with a secret key. The code changes every day and cannot be turned back into who you are or your network address. Location and network organization are looked up on this site's own server from a database file kept there (GeoLite2, by MaxMind). Your network address is not sent to anyone for this, and it is not stored.

I see these statistics in summary form: for example, how many people read an essay, from which cities, and how many visits came from a given university, hospital or company network. Internet providers, mobile networks and privacy relays are left out of the organization list. I do not see or try to work out who any individual reader is, and I do not combine these statistics with any other information to identify people.

If your browser sends Global Privacy Control or Do Not Track, you are not counted at all. Automated visitors, such as search engine crawlers, are not counted either.

Server logs

The service that hosts the site (Google Cloud) keeps standard technical logs of requests: the address requested, the time, your network address and your browser type. They are used only to keep the site working and secure, for example to find errors and stop attacks, and are deleted automatically, normally after 30 days. To protect the contact and sign-up forms against abuse, the site also counts recent requests by a scrambled form of your network address, and deletes those counts after two days.

Cookies and storage on your device

The site does not use cookies or device storage for advertising or for tracking you across websites. It keeps a few small things in your browser so that the site works the way you set it:

• lang (a cookie, for one year): the language you chose, so the site opens in it next time. It is set only when you choose a language.
• Your theme (light or dark) and text size, if you change them.
• The date of your last visit, so a returning visit can be counted as returning. It holds a date, not an identifier.
• Whether you have dismissed the offer to read in your language, or the suggestion to add the site to your phone.
• In SHIFT: your best score, your player name, a random player number, your sound setting and your recent games, so the game remembers you. Notes you add after a game stay on your device.

These stay in your browser. You can delete them at any time in your browser settings, and the site will still work.

Media, fonts and video

Fonts and audio are served from the site itself. Photographs are served from the site's own storage on Google Cloud. Reading a page does not send your information to font, image or analytics companies.

Some essays include a YouTube video. Nothing is loaded from YouTube until you press play. The video then plays in YouTube's privacy-enhanced mode, and from that moment YouTube's own privacy policy applies.

The Listen recordings were made in advance with Google's text-to-speech service and are played from this site, so listening sends nothing to that service.

What you choose to send

Messages

If you use the contact form, the site stores what you send: the topic, your message, your name and email address, and your organization or a link if you add them, with the date. To protect against abuse, it also stores your browser type and a one-way scrambled form of your network address, which cannot be turned back into the address.

Files you attach (up to three, such as a PDF or a photo) are kept in private storage that cannot be reached from the web. Only I can open them, through links that expire after five minutes. When a message arrives, my own devices get a short notice with your name, the topic and the opening words of your message, delivered by the standard notification service of my phone or browser.

Messages are used only to read and reply to you. They are not added to any mailing list. Please do not send medical details or anything confidential through the form: see the Terms.

Subscriptions

If you subscribe, the site stores your email address, your first name if you give it, the updates you chose (essays, letters, photographs or Chroneme updates) and how often, the language you read the site in, and where on the site you signed up. So that I know who reads, it also notes the approximate location (city, region and country) and the organization that runs the network you signed up from, looked up on this site's own server as described under Visit statistics; your network address itself is not stored. When you confirm, my own devices get a short notice with these details, delivered by the standard notification service of my phone or browser. The site also keeps a record of your consent: what you agreed to, when, the wording you saw, your browser type and a scrambled form of your network address. This record exists so that I can show that you asked to receive email.

Nothing is sent until you confirm by pressing a button in the first email. Emails are delivered by Resend, an email service acting only on this site's behalf. Every email has a link to change what you receive, and a one-click unsubscribe. I may label subscribers in broad groups (for example clinician, investor or press) to decide which updates are relevant to send.

If you turn on phone or browser notifications, your phone or browser gives the site an anonymous delivery address, stored with what you chose to be notified about and your browser type. It contains no name or email. Notifications are delivered through your phone or browser maker's notification service (Apple, Google, Mozilla or Microsoft). You can turn them off at any time in your settings.

If you also choose Chroneme updates, after you confirm, your email address is passed to Chroneme for that purpose only, and Chroneme's own privacy policy then applies to it.

SHIFT, the game

When you play SHIFT, the site records the game: your score, how long you played, the mode, your best streak, your device type, screen size and language, and the timing and position of your taps and swipes. It is linked to the random player number on your device, not to who you are. No network address is stored with it.

This is used to keep the leaderboard fair, to improve the game, and to study attention and reaction patterns in anonymous, combined form. SHIFT is a game, not a medical or psychological test, and it does not tell you anything about your health.

If you save a score, the name you type and your country's flag are shown publicly on the leaderboard. Please do not use your full real name unless you want it shown. I may hide names that are offensive or that impersonate someone.

Why the site may use your information

Where the law asks for a reason (a "legal basis"):

• Visit statistics, server logs and security: my legitimate interest in understanding which writing is read, and in keeping the site working and safe, in a way that does not identify you.
• Messages: to reply to you, at your request.
• Email and notifications: your consent, which you can withdraw at any time by unsubscribing or turning notifications off.
• Consent records: to show that you asked to receive email, which the law requires.
• SHIFT: to run the game you chose to play, and my legitimate interest in keeping the leaderboard fair and improving the game.

The site does not use your information for advertising, does not sell it or share it for advertising, and does not make decisions about you by automated means.

Who else handles it

Only services that act on this site's behalf, under their own security and privacy terms:

• Google Cloud (United States): hosts the site, its photographs and its backups, and keeps the server logs.
• Supabase (United States): the site's database, and private storage for contact attachments.
• Resend (United States): delivers email, for subscribers only.
• Apple, Google, Mozilla or Microsoft: deliver notifications, only if you turn them on.
• YouTube: only when you press play on a video.
• Chroneme: only if you choose Chroneme updates.

I may also disclose information if the law requires it, or to protect the site, its readers or myself from fraud, abuse or harm.

Where it is kept, and for how long

The site, its database and its backups are all held in the United States, by Google Cloud and Supabase. If you read from elsewhere, including the European Union or the United Kingdom, your information is handled in the United States. The services above protect it under their own data protection terms, including the standard contractual clauses approved for transfers out of Europe where they apply.

Information is kept only as long as it is useful for the purpose it was collected for:

• Visit statistics: one year. Older statistics are deleted automatically every night.
• SHIFT scores and play records: kept while the game runs, so the leaderboard and your best scores stay. Email me your player name to have yours deleted.
• Messages and attachments: kept so that I can follow up on our conversation, until you ask me to delete them or I no longer need them.
• Subscriptions: while you are subscribed. After you unsubscribe, your address and consent record are kept only as a record of your choice, so that you are not emailed again by mistake. You can ask for them to be deleted.
• Notification addresses: until you turn notifications off, or the address stops working.
• Server logs: normally 30 days.

The site keeps nightly backups, so that nothing is lost by accident. Each backup is deleted after 90 days, so anything deleted from the site is gone from the backups within 90 days. Contact attachments have one private backup copy each, which I delete together with the message.

How it is protected

The database cannot be reached from your browser; only the site's server can read it. Connections are encrypted. Contact attachments are private, and the site checks that each file really is the kind of file it claims to be. Studio, where I write and publish, is protected by a passkey on my own devices. No system is perfectly secure, but the site is built to hold little, and to protect what it holds.

Your rights

Wherever you live, you can ask me:

• what information the site holds about you, and for a copy of it;
• to correct it;
• to delete it;
• to stop using it, or to object to how it is used;
• to send it to you or to another service in a common format.

Email za@jhu.edu. I will reply within one month, and I may need to confirm that the request comes from you. There is no charge. You can withdraw consent at any time, without affecting anything done before. Because visit statistics are anonymous, the site usually cannot find which ones are yours.

If you live in the European Union, the United Kingdom or Switzerland, you can also complain to your data protection authority. If you live in California or another US state with privacy laws, you have the rights those laws give, and you will not be treated differently for using them. The site does not sell or share personal information as those laws define it, and it treats Global Privacy Control as a request to opt out.

Children

This site is written for adults and is not directed at children. It does not knowingly collect information from anyone under 16. If you believe a child has sent information through the site, email me and I will delete it.

Links to other websites

Pages link to other websites, such as Chroneme, OpenCura, LinkedIn and the sources an essay cites. Those websites have their own privacy policies, and this one does not cover them.

Changes

When the site changes how it handles information, this page is updated in the same change, with a new date at the top. If a change is significant and you are a subscriber, I will tell you by email before it applies.

Contact

Zohaib Akhtar, za@jhu.edu.