Privacy

Plain language, no legalese wall. This page describes what the site does today, not what it might do one day. It gets rewritten whenever that changes.

Last updated 29 August 2026

What this site is right now

Static pages served as files. There is no account system, no database, no login, and no tracker yet — those are being built and this page will be rewritten before they ship.

What is collected

Nothing, by this site. There is no analytics, no tag manager, no tracking pixel, no ad network, no fingerprinting, and no third-party script of any kind on any page here.

What is stored in your browser

One thing: your theme choice, under the key udip-theme, inlocalStorage. It holds the word light or dark and nothing else. It never leaves your device, it is not an identifier, and clearing your browser data removes it. If you leave the theme on "system", nothing is stored at all.

Fonts and assets

The typeface is self-hosted from this domain. There is no Google Fonts request, because that would tell a third party which pages you visit, on every page load. Every image, font and stylesheet comes from this site.

The honest caveats

Any privacy page that claims "we collect nothing" without this section is skipping something. Here is what is true anyway.

The host sees requests

This site is served by GitHub Pages. Like any web host, GitHub's infrastructure receives the request — including your IP address and browser user-agent — in order to send the page back. That is how HTTP works, and it happens whether or not I want the data. I do not receive it, I cannot query it, and there is no dashboard on my side showing who visited. It is governed byGitHub's privacy statement.

Two security headers are missing

GitHub Pages cannot set HTTP response headers, so this site cannot sendStrict-Transport-Security or frame-ancestors. A Content Security Policy is applied via a <meta> tag instead, which covers most of the same ground but not those two. This is a real gap, stated rather than hidden, and it is fixed by moving to a host with header control — planned before any account system ships.

Links out are still links out

Links to YouTube, Instagram and TikTok are ordinary links. Nothing loads from those services while you are here, and no request reaches them until you click — but once you do, you are on their site under their rules.

What will never happen

These do not move for money, growth, a partner, or a platform.

Your data is never shared, sold, rented or brokered — not aggregated, not "anonymised", not as a bonus in a partnership.
No tracking pixels, ad networks, profiling analytics, or fingerprinting.
Only the fields a feature actually needs get collected. No phone number, no contacts, no location, no device inventory.
No dark patterns — no fake scarcity, no countdown timers, no guilt-trip unsubscribe flows.
You can always export everything and delete everything, permanently, in one click.

What changes when the tracker ships

Stated now so there are no surprises later. When the tracker exists, this page will be rewritten to describe exactly what it does — and these are the commitments it is being built against.

Sign-in: Google only, requesting only openid, email and profile. No passwords means no password database to leak. No access to your Drive, contacts or calendar — ever.
Where logs live: A PostgreSQL database at Supabase, with row-level security enforced by the database itself, so one account physically cannot read another's rows.
Your email: Never copied into the application's own tables. It cannot leak through a share, an export bug, or a bad join, because it is not there.
Sharing: Off by default. No public profile, no directory, nothing discoverable. If you share a log, it is read-only, revocable instantly, and can carry an expiry date.
Deletion: Permanent, immediate, no 30-day recovery window. The one honest caveat: the database provider keeps automated backups on their own cycle, and this page will state the actual retention window when it applies.

Questions

Email hello@udip.fit. The site's full source is public atgithub.com/udip-rai/udip.fit— so none of the above has to be taken on trust. You can read it.