1. Summary
- No accounts, sign-ups, comments or payments.
- The contact note sends nothing through this site. It opens your own email app with your message filled in, and nothing is sent until you press send there.
- No cookies, analytics, advertising, tracking pixels or session recording.
- Fonts, images and scripts are served from this site itself. No third-party requests are made while you browse.
- The optional camera demo processes video only inside your browser. Nothing is recorded, uploaded or kept.
- Game best scores are saved only on your own device.
2. Who is responsible
This is the personal portfolio of Safal Mutha, based in Pune, Maharashtra, India (“I”, “me”). For the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act), I am the Data Fiduciary. For visitors in the European Economic Area or the United Kingdom, I am the controller under the GDPR and UK GDPR.
3. What is processed
3.1 Server and security logs
Like every website, the hosting and content delivery provider that serves these pages (Cloudflare, through Cloudflare Pages) automatically processes technical request data: IP address, date and time, requested URL, HTTP status, referring page and browser user agent. This is necessary to deliver pages, prevent abuse and keep the service secure. I do not combine this data with anything else, and I do not use it to identify or profile visitors.
3.2 Messages you choose to send
The contact note on the home page does not submit anything to this website. When you press send, it opens your own email app with the note filled in. Only if you then send that email do I receive your name, your email address and whatever you wrote. The same applies if you call or text my phone number or message me on LinkedIn or Instagram: I receive your number or profile and your message. The site only links to those services and loads nothing from them. How long I keep messages is set out in section 6.
3.3 What is not collected
Apart from emails you decide to send me, I do not collect names, email addresses, phone numbers, location, payment details, government identifiers, health data or any sensitive personal data. The interactive demos (donation pipeline, inventory, test-kit scanner, question engine) run entirely in your browser with made-up data. Nothing you do in them is sent anywhere.
4. The photobooth camera demo
The camera is used only if you press “Use my camera” and then grant permission in your browser. Video frames are processed in memory, inside your browser tab, to apply filters. Frames are never recorded, stored on a server, transmitted or analysed for identity. No face recognition is used.
The camera switches off when you press “Stop camera”, scroll away from the demo or leave the page. Snapshots you take exist only in that open tab and are discarded when you reload or close it. You can withdraw camera permission at any time in your browser settings.
5. On-device storage
The mini games on the 404 page save your best score in your browser’s local storage under keys beginning with sm-. While you write a contact note, its unsent draft is kept in your browser’s session storage under sm-note-draft so a reload doesn’t lose it; it is removed when you open it in your email app, press “Write another note”, or close the tab. Neither value leaves your device, is a cookie or is readable by me. Clear them at any time through your browser’s site data settings. If storage is blocked, the games and the note still work and simply won’t remember anything.
6. Data retention
| Data | Where it lives | How long |
|---|---|---|
| Server and security logs | Cloudflare (hosting provider) | I do not collect or keep these logs myself. Cloudflare keeps them only as long as it needs for delivery and security, as set out in its own privacy policy. |
| Camera frames | Your browser memory | Not retained. Each frame is discarded once drawn. |
| Photobooth snapshots | Your open browser tab | Until you reload or close the tab. |
| Game best scores | Your browser’s local storage | Until you clear site data. |
| Unsent contact note draft | Your browser’s session storage | Until you open it in your email app, start a new note, or close the tab. |
| Messages you send me | My email inbox, phone, LinkedIn or Instagram account | Only as long as needed to reply, then deleted within 12 months, unless you ask me to delete them sooner. |
When a retention period ends, data is deleted or irreversibly anonymised.
7. Legal basis
- Server logs: legitimate uses for security and service delivery under the DPDP Act, and legitimate interests under Article 6(1)(f) GDPR.
- Camera demo: your explicit, informed consent, given by pressing the button and granting browser permission. You can withdraw it at any time as easily as you gave it.
- Emails, calls and messages you send me: your consent, given by choosing to send the email, and my legitimate interest in replying to you. You can ask me to delete your messages at any time.
- Local storage for scores and the session storage draft of an unsent note: strictly necessary to provide a feature you choose to use. Neither leaves your device.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data held about you, and learn how it is used;
- correct, complete or update it;
- have it erased;
- withdraw consent at any time, without affecting earlier processing;
- object to or restrict processing, and receive data in a portable format (GDPR);
- nominate another person to exercise your rights in case of death or incapacity (DPDP Act);
- have a grievance addressed, and then complain to the Data Protection Board of India or your local data protection authority.
Because almost no personal data is processed, most requests will be answered by confirming that nothing is held. I respond within 30 days.
10. Children
This site is suitable for all ages and does not knowingly collect personal data from anyone, including children. It does not track, profile or target advertising at any visitor. A parent or guardian who believes a child’s data has been processed can contact me, and I will delete it.
11. Security
The site is a static, prerendered website with no database or server code. It is served only over HTTPS, with a strict Content Security Policy, HSTS, clickjacking protection and a Permissions Policy that allows only the camera, only on this site. No secrets or API keys exist in the code.
12. External links
Links to hopemeals.org, elitemathsacademy.in, the IJARIIT journal and other sites open in a new tab. Those sites have their own privacy policies, which I do not control. Links are sent with no referrer information.
13. Changes
If this policy changes, the updated version will be published here with a new “last updated” date. Material changes will be highlighted on this page.
14. Contact and grievances
For any privacy question, rights request or grievance, contact Safal Mutha by email at muthasafal@gmail.com. I aim to acknowledge requests within 7 days and resolve them within 30 days.