Privacy policy

Draft — not yet reviewed by a lawyer

This page was drafted as a starting point for Mike Sader and has not been reviewed by a qualified lawyer. It should be reviewed against Lebanese law and any other law that applies to visitors before the site is promoted publicly. Until then, treat it as a working draft.

This policy explains what Insights by Mike collects from you, why, and what you can do about it. It is written to be read, not to be survived.

Who is responsible

Insights by Mike is run by Mike Sader, based in Lebanon. For anything in this policy, contactcontact@insightsbymike.com.

What is collected, and why

If you only read the site

Nothing identifying. There is no advertising network, no third-party tracker and no cross-site profiling on this site. Page views are measured with Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors or build a profile of you.

If you create a free account

  • Email address (required) — to verify who you are, sign you in, and send you what you asked for.
  • First name (required) — so pages and emails can address you properly.
  • Country (required) — to understand where the audience is and to shape what gets written.
  • Phone number (optional) — only if you choose to give it. It is never required to download anything, and leaving it blank changes nothing about your access.
  • Professional status and interests (optional) — to make what you are sent more relevant.

Automatically, when you use an account

  • Which resources you unlocked and downloaded, and when — this is what makes your library work.
  • A one-way hash of your IP address and browser user agent, kept to limit abuse and rate-limit sign-in attempts. These are digests, not the values themselves, and cannot be reversed back to you.
  • Session records, so you can see and end active sessions.

If you contact me or subscribe

  • Your name, email and message, so I can reply.
  • Your newsletter preferences, and a record of when and on which page you consented.

On what basis

  • Your consent — for the newsletter and for any WhatsApp or SMS updates. Both are separate, unticked boxes, and neither is bundled with access to a free resource.
  • Performing what you asked for — creating your account, verifying your email and delivering a resource you requested.
  • Legitimate interest — keeping the site secure, preventing abuse, and understanding aggregate usage.

Marketing consent is never a condition of getting a free resource. If you decline both boxes, you still get the file.

Who processes your information

  • Cloudflare — hosting, the database (D1), file storage (R2), bot protection (Turnstile) and cookieless analytics. Data is stored on Cloudflare infrastructure.
  • Resend — sending transactional email (verification codes, newsletter confirmations). Resend receives your email address and the content of those messages.

Your information is not sold, rented or shared with advertisers. There are none.

How long it is kept

  • Account and library records — until you delete your account.
  • Verification codes and sign-in links — 15 minutes, then they expire and are unusable.
  • Sessions — 30 days from last use, or until you log out or revoke them.
  • Contact messages — up to 24 months, so I can follow up on a conversation.
  • Consent records — kept as a history even after you withdraw consent, because the record of when consent was given and withdrawn is the point of having it.
  • Analytics events — aggregate counts with no personal identifiers.

How it is protected

  • There are no passwords on this site, so there is no password database to breach.
  • Session tokens, verification codes and sign-in links are stored only as cryptographic digests. Codes are additionally combined with a server-side secret before hashing.
  • Downloads are served through short-lived, single-user links; files are never publicly addressable.
  • All traffic is served over HTTPS.
  • IP addresses and user agents are stored as truncated one-way hashes, never in the clear.

No system is perfectly secure, and it would be dishonest to claim otherwise.

Your choices

  • Unsubscribe — one click from the bottom of any newsletter email, or from your account page.
  • Withdraw consent — change your preferences at any time in your account. It takes effect immediately.
  • Export your data — download everything held about you as a JSON file from your account page.
  • Delete your account — from your account page. Your profile, sessions, library and any phone number are erased and your email is removed from the account record. Consent history is retained in anonymised form.
  • Ask a question or make a complaint — contact@insightsbymike.com.

Cookies

Only what is needed to run the site: a session cookie when you are signed in, a CSRF cookie to protect forms, and a short-lived cookie during registration. No advertising or tracking cookies are set. See thecookie policy for the full list.

Children

This site is aimed at adults — students, professionals and business owners — and accounts are not intended for anyone under 16. If you believe a child has created an account, contact me and I will remove it.

Changes

If this policy changes materially, the version number at the side of this page changes with it, and new consents are recorded against the new version. Material changes will be announced in the newsletter.

Questions about this page? Get in touch.