Privacy policy

The Arif's Story is a personal, non-commercial website where Arif shares a personal banknote and coin collection. This page explains what little information the site handles and why.

You can browse the whole collection without an account and without telling us anything about yourself.

Like most websites, the server sees technical details of each request, such as your IP address, browser type and the page you asked for. These are used to keep the site running and to block abuse (for example rate limiting and bot detection), and security logs are kept only as long as they are useful for that.

If site analytics is switched on, Google Analytics may collect anonymous usage statistics such as which pages are popular. This is only used to understand how the site is used.

The contact form asks for your name, email address, a subject and your message. These are emailed to Arif, who can then reply, and a copy of the confirmation is emailed to you.

Your message is not used for marketing and is never sold or shared. Please don't include anything sensitive.

An account stores your name, email address and a securely hashed password (the plain password is never saved). If you sign in with Google or GitHub, we store the identifier those services give us to link your account.

If you turn on two-factor authentication, the secret needed to check your codes is stored with your account.

Accounts exist to manage the site. You can ask for your account and its data to be deleted at any time through the contact page.

Signing in sets HttpOnly cookies that keep you logged in securely. They are strictly necessary for accounts and are not used for tracking.

Your light/dark theme choice is remembered in your browser's local storage. If analytics is enabled, Google Analytics may set its own cookies.

Collection data and accounts are stored in a MongoDB database. Banknote photos are hosted on Cloudinary. Emails are sent through an email (SMTP) provider. Google and GitHub are only involved if you choose to sign in with them.

Each of these services has its own privacy policy covering how they process data on our behalf.

You can ask what information is held about you, ask for it to be corrected, or ask for it to be deleted. Just send a request through the contact page.

If this policy changes, the date at the top of this page will change too. Continuing to use the site after an update means you accept the new version.