Privacy

Privacy Policy

Last updated 7 August 2026

1. Who is responsible for your data

This website, siddhantkumar.in, is a personal website operated by Siddhant Kumar, an individual based in Delhi Cantonment, Delhi, India. For the purposes of the EU and UK General Data Protection Regulation I am the data controller; under India's Digital Personal Data Protection Act, 2023 I am the Data Fiduciary.

You can reach me about anything on this page at sid@siddhantkumar.in. This address is also the grievance contact for DPDP Act purposes.

2. What I actually collect

a. When you write to me

The contact form on the home page, the book waitlist form and the journal sign-up form each ask for a name, an email address, an optional subject and your message. That is all they ask for, and all of it is optional in the sense that you are free not to use the form and email me instead.

These forms are delivered by FormSubmit (formsubmit.co), a third-party form-forwarding service, which passes the contents to my email inbox. Your message therefore passes through FormSubmit's systems on its way to me. I do not use FormSubmit for anything else, and no mailing list is built from these submissions.

b. Ordinary server records

Like effectively every website, the hosting provider that serves these pages keeps standard technical logs — typically your IP address, browser user-agent, the page requested and a timestamp. These exist so the site can be delivered and kept secure. I do not use them to build any profile of you, and I do not combine them with anything else.

c. A preference stored on your own device

The project build guides let you switch between a light and a dark reading theme. If you use that switch, the choice is saved in your browser's localStorage under the key sk-doc-theme. It is a single word such as light. It is not a cookie, it is never transmitted anywhere, it contains nothing that identifies you, and clearing your browser's site data removes it.

3. What I deliberately do not do

• No cookies of any kind — not analytics, not advertising, not "essential" ones either.
• No Google Analytics or any other analytics or heat-mapping product.
• No advertising networks, no retargeting, no tracking pixels, no social media "like" widgets.
• No fingerprinting, no cross-site tracking, no profiling and no automated decision-making.
• No selling, renting or sharing of personal data. There is nothing to opt out of, because it does not happen.
• No newsletters sent without you asking, and no marketing email at all as things stand.

4. Third parties that can see something

Fonts used to be loaded from Google Fonts. They are now self-hosted on this domain precisely so that no request — and therefore no IP address — is sent to Google when you read a page here.

5. Why I am allowed to process it (GDPR Article 6)

• Your consent, and your evident intention to be replied to, when you send a message through a form or by email — Article 6(1)(a) and 6(1)(b).
• Legitimate interests for the ordinary server logs described above: keeping the site available, and protecting it from abuse — Article 6(1)(f).

Where consent is the basis, you may withdraw it at any time; that does not affect processing already carried out.

6. How long anything is kept

Messages you send me live in my email account. I keep correspondence for as long as it is useful to keep — typically because a conversation is ongoing or because it is a record of a recognition or an enquiry worth retaining — and delete it when it is not. If you ask me to delete your message, I will, and I will confirm when it is done.

Server logs are retained for the period my hosting provider applies to them, which is generally short and measured in weeks.

7. Where your data goes

I am in India. FormSubmit and my hosting provider may process data outside your country, including in the United States. Where personal data of individuals in the EU or UK is transferred internationally, it is transferred on the basis of the recipients' own safeguards, such as Standard Contractual Clauses. Given the very small amount of data involved — a message you chose to send — this is a modest transfer, but you should know it happens before you use the form. If you would rather not have your message routed through a third-party form service, simply email me directly.

8. Your rights

If you are in the EU or the UK (GDPR / UK GDPR)

You have the right to access the personal data I hold about you, to have it corrected, to have it erased, to restrict or object to how it is processed, to receive it in a portable form, and to withdraw consent. You also have the right to complain to your data protection supervisory authority — in the UK, the Information Commissioner's Office; in the EU, your national authority.

If you are in India (DPDP Act, 2023)

You have the right to obtain a summary of your personal data and how it is processed, to correction and completion, to erasure, to nominate another person to exercise your rights, and to a grievance redressal process. Write to me at the address above and I will treat it as a grievance and respond.

If you are in California (CCPA / CPRA)

In the twelve months preceding the date at the top of this page, the only category of personal information collected has been identifiers and electronic communications you voluntarily submitted — your name, email address and message — collected for the sole purpose of replying to you. I have not sold or shared personal information, and I do not process sensitive personal information for inferring characteristics. You have the right to know, to delete, to correct, and not to be discriminated against for exercising those rights. There is no "Do Not Sell or Share My Personal Information" link because no sale or sharing takes place.

To exercise any of these rights, email me. I will not charge you and I will respond within the time the applicable law allows — one month under the GDPR, and promptly in every other case. I may ask you a question to confirm you are the person the data relates to.

9. How to contact me — and how notices must be sent

Email is the only channel I accept. Every privacy request, rights request, question, complaint, grievance and legal notice relating to this website must be sent by email to sid@siddhantkumar.in. That address is monitored, it is the designated point of contact for the purposes of the GDPR and the UK GDPR, and it is the grievance contact for the purposes of India's Digital Personal Data Protection Act, 2023.

No postal address is maintained for correspondence or for service of documents. This is a personal website run by one person; there is no office, no registered address for this site and no postal handling. Anything sent physically — a letter, a legal notice, a courier or a summons delivered by hand — is not monitored, is not accepted as valid service, and may simply never reach me. Please do not send anything on paper. If you do, treat it as not delivered and send it again by email.

To help me deal with your message quickly, put the nature of it in the subject line — for example Privacy request, Erasure request, Grievance or Legal notice — and tell me what you would like me to do. I will acknowledge receipt and respond within the period the applicable law allows: one month under the GDPR and the UK GDPR, and promptly in every other case. There is no charge.

Two things this does not change. First, you keep the right to complain directly to a regulator instead of, or as well as, writing to me — your data protection supervisory authority in the EU, the Information Commissioner's Office in the UK, or the Data Protection Board in India — and those bodies follow their own procedures. Second, where a law or a court mandates a specific method of service for a particular document, that law naturally prevails over the preference stated here.

10. Children

This website is a personal and literary site intended for a general audience. It is not directed at children, and I do not knowingly collect personal data from a child. If you believe a child has sent me personal data, write to me and I will delete it.

11. Security

The site is served over HTTPS. It is a static website: there is no database, no user account, no login and no stored payment information, which removes most of the ways a website ordinarily leaks personal data. Email correspondence is held in my email provider's account, protected by that provider's security and my own credentials. No method of transmission over the internet is completely secure, and I cannot promise absolute security.

12. Changes to this policy

If the way this site handles data changes — for example if analytics were ever added — this page will be updated and the date at the top will change. Material changes will be described here rather than made quietly.