Privacy Policy

At saiemgilani.com, I do not collect contact information and there is no traditional account system — no email or password logins, no forms, no newsletter sign-up. The only data that touches the site is what every web request carries, plus the two features described below, and here is what happens to it.

Analytics. Page views go to Plausible, a privacy-focused service that counts them without cookies or cross-site tracking. Plausible receives the request's IP address and user agent but discards them after computing a daily, salted, non-reversible hash; it does not store them. I see only aggregate counts of which pages people read.

The lab. Browser-run lab entries under /lab run in your browser. When one reads a public SportsDataverse data file, the request passes through this site and on to GitHub's release servers, which see it as they would any download. To stop abuse, the relay limits how many requests each IP address can make over a short period; that tally lives in memory only and is not stored or logged. Python and LLM entries run on this site's API server instead — № 002's calculation runs in an API child process, and № 003's messages go to the model provider through Vercel AI Gateway — as described under "Lab runs" below.

View counts. Each note shows a view count. To count a visitor once per day, the site sends its backend a keyed hash (HMAC) of the visitor's IP address, never the address itself. Those hashes are kept for the current and previous two calendar days (purged daily once older than that), then only totals remain.

Lab runs. Running a gated lab entry needs a GitHub sign-in. We store your GitHub id and login (never your email), a per-entry per-day run counter, and each run's result plus a hash of its parameters (never the parameters themselves) for 90 days (RUN_RETENTION_DAYS), after which the results, hashes and counters are all purged by a daily job. LLM entries send your messages to the model provider through Vercel AI Gateway; this site does not store them. Signed-out visitors see a cached example and nothing about them is stored.

Sign-in. Sign-in with GitHub is optional and only needed to run gated lab experiments. The session cookie carries your GitHub id and login — no email, no avatar, no access token — and Auth.js sets its usual csrf/callback/session cookies for that flow. Nothing is set until you sign in.

Hosting and third parties. The site runs on Vercel, which handles requests the way any host does, including standard request logs it keeps for operating the service. Pages also load some assets from GitHub and jsDelivr. Each of these providers has its own privacy policy. I do not sell, rent or otherwise share anything with anyone else, except as required by law.

I may update this policy from time to time; changes are posted here.

If you have any questions or concerns about the Privacy Policy, please contact me at saiem.gilani@gmail.com.