Privacy policy

Effective 26 October 2026

This policy explains what information is processed by romanvaxman.com and its private dashboard at dashboard.romanvaxman.com (together, "the site"). The site is run by Roman Vaxman for personal use. Questions go to info@romanvaxman.com.

Public pages

The public pages of romanvaxman.com do not use cookies, analytics, advertising or tracking scripts, and they have no forms. The site is delivered through Cloudflare, which processes standard request data such as IP address, browser user agent and the page requested in order to deliver the site and protect it from abuse. See Cloudflare's privacy policy.

Private dashboard

The dashboard is for the site owner only. There is no public sign-up, and accounts are not offered to anyone else. When someone signs in or tries to, the site processes:

• Email address, to identify the account.
• Password, stored only as a one-way Argon2id hash. The password itself is never stored.
• Sign-in codes sent by email for two-step verification. Codes are stored only in hashed form and expire after 10 minutes.
• A session cookie that keeps a signed-in user signed in. It is strictly necessary, is not used for tracking, and ends after 24 hours of inactivity or 7 days at most.
• IP address and time of failed sign-in attempts, used only to rate-limit attacks. These records are deleted within an hour.

Sign in with Google

If you choose "Continue with Google", the site asks Google only for your email address, whether Google has verified it, and your Google account identifier (the openid and email scopes). This information is used solely to confirm that the person signing in is the site owner. The account identifier is stored to recognise the same Google account next time. The site does not request access to Gmail, Drive, contacts or any other Google data, and it does not keep Google access tokens.

The site's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information from Google is never sold, never used for advertising, and never shared with anyone except as needed to provide sign-in or as required by law.

You can remove the site's access at any time at myaccount.google.com/permissions.

Who else processes data

• Cloudflare delivers and protects the site.
• Resend delivers sign-in code emails.
• Google provides "Sign in with Google" when you choose it.

Personal information is not sold, rented or shared for marketing.

Security

All traffic uses HTTPS. Passwords and sign-in codes are stored only in hashed form, sign-in attempts are rate-limited, and the dashboard is read-only by design.

Your choices

You can ask what information the site holds about you, or ask for it to be deleted, by writing to info@romanvaxman.com.

Children

The site is not directed at children and does not knowingly collect information from anyone under 13.

Changes

If this policy changes, the updated version will be posted on this page with a new effective date.