Legal
Privacy
This site has one form and no tracking. Below is every field it stores, every company that touches it, and how to make me delete it.
Last updated
Sadiqeen Co is a trading name of Jarra Omar, a contract software engineer operating from California. I am the only person with access to anything described on this page.
This is written against the code that runs, not against a template. Where it describes a limit or a schedule, that limit is enforced by the software rather than by my intention to honour it.
What the contact form stores
Five fields are required, because a reply is impossible without them:
- First name and last name — stored separately so a reply can open with your first name rather than your full one
- Email address — normalised to lowercase before it is stored
- Your message
- How you found me — one of a fixed list of options
Four are optional and blank unless you choose them:
- Company
- Project type, budget range, and timeline — each one of a fixed list
Nothing else on the form is stored. The form measures how long it was open before you submitted it, because a submission completed in under two seconds was not typed by a person; that timestamp is compared and then discarded. There is also a field that is invisible to you and should always be empty. If it is filled, the submission is dropped. Neither value is ever written to the database.
What is recorded alongside it
Three things are attached to your message by the server rather than by you:
- A hash of your IP address. The address itself is never written down. What is stored is an HMAC-SHA256 digest computed with a secret key that is not in the database, which cannot be reversed to an address without that key. A plain hash would not be good enough here — there are only about four billion IPv4 addresses, so an unsalted digest of one can be reversed by anybody with a laptop and an afternoon. That is the reason for the key.
- Your browser's user-agent string, truncated to 500 characters.
- Which environment received the submission — the literal word "production". This is not a referrer, a UTM tag, or a landing path. The site does not record where you came from.
I use these two provenance fields to tell one abusive sender apart from many separate people. That is their only purpose.
How long it is kept
Your name, email, and message are kept indefinitely, until I delete them. They are a record of a business enquiry and I would rather be able to find our earlier conversation than not.
The IP hash and the user-agent string are erased after 90 days, on a scheduled job that runs daily inside the database. Your message survives; its provenance does not. This is not a policy I intend to follow — it is a job that runs whether or not I remember it exists.
Who else touches it
Four companies are involved in getting your message from your browser to my inbox. There are no others: no advertising network, no marketing platform, no CRM, no session recorder.
| Company | What it handles | What it sees |
|---|---|---|
| Vercel | Hosting and page analytics | Your IP address, as any web server does. Analytics are aggregate and cookieless — no identifier follows you between sites. |
| Supabase | The database your message is stored in | Everything listed above, at rest. |
| Cloudflare | The anti-bot check on the contact page | Your IP address and browser signals, to decide whether you are a person. It never sees your message. |
| Delivers the notification email to my inbox | The contents of your submission, as the body of that email. |
Each is a large hosting provider with its own privacy documentation, and each processes this data on my instructions.
Tracking
This site sets no cookies of its own and loads no third-party scripts on its public pages. That is not a preference — the homepage's third-party request budget is zero, and an automated test fails the build if a single one appears. Fonts are served from this domain rather than from a font CDN for the same reason.
The contact page is the one exception, and it is a deliberate one: it loads Cloudflare's anti-bot widget, which is what stops the form being used to send mail. Cloudflare may set its own cookie as part of that check. Every other page on this site loads nothing from anywhere but this site.
Page analytics record which pages are visited and rough aggregate figures. They do not build a profile, do not follow you to other sites, and do not identify you.
What I do not do
- I do not sell, rent, or share your information with anyone.
- I do not send marketing email. If you write to me, I reply to you — that is the entire mailing list.
- I do not use your message to train a machine-learning model.
Asking to see it, correct it, or delete it
Email jarraomar4@gmail.com and say what you want. I will tell you everything I hold about you, correct it, or delete it outright, and I will do it within 30 days. There is no form and no account to log into.
Deletion means the row is removed, not flagged. The only thing I cannot undo is the notification email that already reached my inbox, which I will delete on the same request.
I offer this to everybody who asks, wherever you live, rather than only to people covered by a particular law.
Changes
If this page changes materially, the date at the top changes with it. Older versions are in this site's git history.