Privacy policy

• We collect little: what you send us, what we need to make your website and bill you, and a record of visits to our samples.
• On a sample, we record which pages you open, which parts of them you look at and which links and buttons you tap, when and for how long, your device and its IP address, so we know whether you’ve seen it and when to follow up. The sample says so on screen, and you can turn it off. In some places we ask first.
• Our emails carry no image, so opening one tells us nothing.
• Only the two of us look at these records, with the services that run our work: Cloudflare stores them, Claude, Anthropic’s AI assistant, reads them for us, and we email ourselves a short note about each visit, without its IP address.
• We don’t sell personal information, or share it with advertisers.

This policy covers this website, the samples and proposals we make at proposals.kartikey.dev, our emails, and our work for clients.

Sweta and Kartikey: the business of Kartikey Tanna, a sole proprietor at 317, Gokuldham Society, Krishna Nagar Main Road, Rajkot 360004, Gujarat, India. We decide how the information on this page is used.

Questions, requests and complaints go to our Grievance Officer, Kartikey Tanna, at hi@kartikey.dev. We answer within a month.

A sample is a website we make for one business, at its own link. On the samples that say so on screen, we record visits that Cloudflare, our web host, places in the United States.

What we record

• The sample and the page; when you opened it, how long it was on screen and how far down it was read.
• Which parts of the page you look at: each part that was on screen, and for how long.
• Which links and buttons you tap, and when: a link by its words and where it leads (a page of the sample, or another site by its name only; for an email or phone link, not its address), a button or a question by its words, and the tick box on our proposal page, ticked or not. Only words we wrote into the sample are kept.
• Your device, browser and screen size.
• The site that linked to it, by its name only, and which of our emails the link came from.
• Your IP address, and the approximate place Cloudflare gives for it: town, region, country, postal code, time zone and network.
• Which wording of our notice was on screen, and, where we asked first, your answer.
• The Cloudflare data centre that answered, and whether the browser says it’s automated.

Each sample’s link went to one business, so we can tell whose link was used. We group page views into visits, and may note a return, or another device or town opening the same link, as a guess that it was passed on.

About ten minutes after a visit ends, we email ourselves a short note about it, so we know without looking: the sample, which of our emails the link came from, the kind of device and browser, the town and network, and the pages, parts looked at and links and buttons tapped, with their times. A tap on Pay or Book a call on our proposal page sends one at once. The notes never hold the IP address. Resend sends them, or Cloudflare if Resend can’t, to our own Gmail, and we keep and delete them like the rest of the visit records (below).

What we don’t record

Anything you type or fill in, or tap inside a form (the samples’ forms send nothing), search terms, the part of an address after “?” or “#” (apart from our own tag in the link we emailed, such as “?e=1”), the full address of another site, where on the screen you tap, mouse movements, screen recordings, other sites you visit, or anything from another company’s script. Our visit records store nothing on your device except your own yes, or your “don’t record me”. (A sample may remember a choice you make on it, such as sorting shops by distance, on your device only; that isn’t sent to us.)

Where we ask first

For visitors Cloudflare places in Pennsylvania, Maryland, Florida, New Hampshire or Nevada, or in the United States but no state, and on our samples for businesses in Pennsylvania and Maryland, the sample asks “Record my visits on this browser?” and records nothing unless you say yes. A no, or no answer, still shows you the whole sample. A yes is remembered on that browser for 180 days, and you can take it back with one tap. A yes covers only what its question named: a yes to the earlier question, which didn’t name the parts you look at or the links and buttons you tap, still covers only the pages, time, device and IP address.

Who we don’t record

• Visitors Cloudflare doesn’t place in the United States. Placing an address can be wrong (a VPN, travel), so we promise only this: we keep visit records only for visits Cloudflare places in the United States.
• Browsers that send Global Privacy Control or Do Not Track. We check in the browser and again on our server.
• Anyone who taps “Don’t record me on this browser”, from then on.

For them we keep no visit record, only a daily count of requests set aside, by reason, with no address or page. Delivering any page still passes your IP address through Cloudflare, as with any web host.

“Don’t record me on this browser”

It’s on every sample that records visits. It stops recording on that browser at once, and deletes from the records we use the pages recorded from that browser on that network in the last 12 hours; the locked security log below keeps its copy for its 180 days, as with any deletion. It lasts a year on that browser: clearing its site data, or using another device, starts afresh.

When you visit this website, a sample or a proposal

• Our pages are served by Cloudflare. Like any web host, it handles your IP address and browser details to deliver each page and protect it from attacks.
• Some samples show a map from Google Maps, or a video from YouTube that loads only when you tap play. Those come from Google, which receives your visit under its own privacy policy. Apart from those, no other company’s content loads on our pages, except Cloudflare’s Turnstile on the form at /start, as below.

When you email us

Your name, email address and what you write, so we can reply and keep a record of our work together. Our email is with Google (Google Workspace).

When you send us a website

• The website, your name and your email, so we can make a sample and write to you.
• We email you a button, to check the website is yours. If you don’t press it, we send up to three reminders over a week, and then stop. Every one has a link that stops them.
• If you tell us you don’t have an email at your website, we email you once, with a link to book a call.
• If you ask us to stop, we delete what you sent, and keep only your email address, so we never write to it again.
• Which link brought you, from a short tag in its address, so we know where it was shared.
• Whether Cloudflare Turnstile thinks a person filled in the form. It runs in the background with no puzzle, once you start filling it in, and Cloudflare handles your IP address and browser details to decide. If it can’t run, your website still reaches us.
• A daily count of sends from your connection, under a scrambled code that changes every day. We don’t keep your IP address with what you send.
• We email ourselves a short note when you press the button or ask for a call, with your name, your email and the website.

If we’re thinking of making a sample for your business, or made one

• Your business’s name, website and the contact details it publishes, so we can decide whether to make a sample, and write to you.
• What your business has published: its website, social pages, Google listing and news stories. That can include people’s names and photos, such as the owner’s or the team’s. We use them only for your sample and our proposal to you.
• A record of what we sent and when, and anything you reply.

If you buy from us

• Your name, your business’s name and address, your email and phone number, what we agreed, what we delivered, and our invoices to you.
• Payments go through Stripe, which gives us your name, email and billing address, and your card’s brand, last four digits and expiry date. We never see the full card number.

On the websites we make for clients

The business decides what its website collects. Messages sent through its forms go to the business’s own inbox. We use them for nothing else.

To make samples and proposals, to write to you and reply, to build, launch and look after your website, to bill you, and to keep the records that Indian tax and export law requires.

To make a sample of a website someone sends us, and to write to them about it.

Visit records tell us whether a business has seen our sample, when to follow up, and how to make our samples better.

Nothing else: no advertising, no profiles, and nothing sold.

• Cloudflare hosts our website, our samples and the websites we launch, stores for us the visit records and what you send through the form at /start, and checks that form with Turnstile, under its data processing terms, which allow it to use its own sub-processors and to disclose data when the law compels it.
• Resend sends the emails the form at /start sends you, and the short notes we email ourselves about visits, which hold no IP address, under its data processing terms, and keeps a copy of each for 30 days. Google keeps the notes in our Gmail.
• Anthropic: Claude, its AI assistant, runs much of our work and reads the visit records to tell us about visits. Anthropic (Claude) and OpenAI (Codex) provide AI tools that help us research, write and build. They work with what we give them: mostly what businesses publish, and our notes and emails about the work.
• Google runs our email. Its maps and YouTube videos appear on some samples.
• Stripe takes card payments.
• If we write to you another way, such as by Facebook Messenger or text message, that service carries the message.
• Our bank and accountant in India, and India’s tax and foreign-exchange authorities, receive the invoice and payment records that Indian tax and export rules require.
• Anyone the law requires us to tell, such as a court, or India’s cyber-security agency (CERT-In) after a security incident.

Nobody else. We don’t sell personal information, or share it with advertisers or data brokers. Apart from Google, through the maps and videos on some samples, and Cloudflare’s Turnstile on that form, no other company collects information through our pages.

• The full IP address in visit records: 180 days, then only its first three parts, such as 73.12.4.x.
• The rest of each visit, the notes we email ourselves about it included: while we’re talking with the business about its sample, until 30 days after that ends (its sample comes down, or we agree to work together), and never more than 12 months. After that, only totals across all our samples, tied to no business.
• A business’s visit records: deleted within 30 days of a no, a “stop”, or a request.
• A locked security log of each recorded page view and yes, with its IP address, kept 180 days for India’s cyber-security rules. It’s never shown on our dashboard or used to follow up, and is read only after a security incident or for a lawful request.
• Your yes, where we asked: as long as the records it covers.
• What you send through the form at /start, and the notes we email ourselves about it: up to 12 months, or, if we work together, as records of our work together. Deleted within 30 days of a request.
• If you asked us to stop writing to you through that form: your email address alone, for as long as we need it to keep to that.
• Emails and records of our work together: while we work together, then for as long as Indian tax and export law requires.
• Invoices and payment records: for as long as Indian tax and export law requires.
• A sample: until you ask us to take it down, or the date we told you. Then we delete our working copies of your pages and photos. We keep our emails with you, and if you asked us not to write again, a note saying so. Older copies can remain in our private version history, which we don’t use.

India’s new data protection law takes effect on 13 May 2027. By then we will either ask every visitor first, or stop recording visits, and update this page.

• Tap “Don’t record me on this browser” on a sample, or send Global Privacy Control or Do Not Track from your browser.
• Ask us what we hold about you, to correct it, or to delete it, or object to how we use it. We’ll do it within 30 days of your asking, keeping only what the law requires (our backups, and the locked security log for its 180 days), and tell you what we kept and why.
• If we turn a request down, ask us to look again: write “appeal” to hi@kartikey.dev, and we’ll answer within a month.
• Stop our emails: reply “no thanks” to any of them, and we won’t write again.
• Ask us to take a sample down, whenever you like.
• Complain to our Grievance Officer, named above. We answer within a month.

Our work is for businesses. We don’t knowingly collect information about children.

We work from India, on our own computers. Cloudflare stores the visit records for us, in the data centres we ask it for, in eastern North America; we read them from India, and keep a copy for our own dashboard, behind a login, and the short notes about visits in our Gmail. The other services above keep information in the United States and other countries.

Card details go only to Stripe. We never ask for passwords by email. We keep what we hold in our own accounts, and share it only as this page says.

If records we hold leak, we report it to India’s cyber-security agency (CERT-In) within 6 hours of noticing, and tell the people affected.

Before we change how we handle information, we update this page and its date. A change never applies to records collected before it without asking.