Privacy Policy

This Privacy Policy explains how Ashik Muhammed (trading as FIA Design, "we", "us", "our") collects, uses, stores, and protects information when you visit this portfolio website and interact with its features, including the contact form, the built-in chat assistant, and the blog.

By using this website you acknowledge that you have read and understood this policy. If you disagree with any part, please discontinue use of the site.

The data controller for this website is:

We are a freelance professional operation, not a registered company. This policy applies to all pages and features of this portfolio website, hosted at ashikmuhammed.com on Vercel, and covers the portfolio, contact form, chat assistants, and the blog.

A. Automatically collected (all visitors)

B. Contact form (only if you submit)

C. Chat assistant (Fahmidha)

D. Blog (when you read a post)

E. DNS resolution via ashikmuhammed.com / Cloudflare (passive, infrastructure-level)

• Automatic tracking script — a lightweight JavaScript snippet runs on page load across all pages (including the blog). It calls ipinfo.io to look up your IP location, then sends the result to our backend API.
• HTTP headers — your browser automatically sends headers including the user-agent (device/browser info) and referrer (where you came from). We read these server-side.
• Contact form submission — data you voluntarily type and submit via the contact form.
• Chat assistant — text you type in the chat widget is processed entirely within your browser using pre-built response logic. Nothing is transmitted to any external server.
• Blog post views — when you open a blog post, our API increments an anonymous view counter for that post server-side. No personal data is attached to this action beyond the standard visit log already described above.
• Books page — visiting /books is tracked by the standard visit script only. No personal data is collected. Book entries are read-only public content managed by the admin.
• Tools page — visiting /tools is tracked by the standard visit script only. No additional data is collected. Tools are publicly available and do not require sign-in.
• Fahmidha profile page — visiting /fahmidha.html (when enabled by the admin) is tracked by the standard visit script only. No personal data beyond a page visit is collected.
• Testimonial submission — if you voluntarily submit a testimonial via the form on the site, we collect your name, role, company, service used, rating, and review text. This is stored in our database in a pending state until approved by the admin. You will receive no automated email; the admin is notified of the submission.

We do not use third-party analytics scripts (e.g. Google Analytics), advertising pixels, or social media trackers.

We do not use your data for advertising, automated profiling, or any decision-making that produces legal or significant effects on you.

This website features a built-in chat assistant named Fahmidha, created to help visitors learn about Ashik Muhammed's services, portfolio, skills, and availability.

About Fahmidha:

• Fahmidha — calm, professional, and precise. Ideal for straightforward service and portfolio enquiries.
• Fahmidha — friendly, energetic, and engaging. A warmer conversational style for visitors exploring what Ashik offers.

What the chat assistants can help with:

• Information about Ashik's services (design, web development, marketing, cybersecurity)
• Portfolio and project details
• Pricing and collaboration enquiries
• Skills and technology stack
• Blog and articles overview
• How to get in touch with Ashik

How it works technically:

• Responses are generated using pre-built keyword and intent logic stored in the page's JavaScript
• Your name (if you share it) is stored only in browser memory for the current session
• All conversation data is automatically cleared when you close or refresh the tab
• No external API calls are made during a chat session

To opt out: Simply do not open or use the chat widget. No data of any kind is collected from the chat unless you actively interact with it.

This website relies on the following external services. Each processes data independently under their own policies:

For details on the blog system's data handling, see Section 07C.

We do not share data with any advertising networks, data brokers, or marketing platforms.

How we use ashikmuhammed.com:

• We registered a subdomain (ashikmuhammed.com) by submitting a small JSON configuration file to ashikmuhammed.com's public GitHub repository via a pull request — no payment, account creation, or personal information was required on our part.
• Once approved, ashikmuhammed.com published a DNS record so the subdomain resolves to this site's Vercel hosting.
• The DNS record itself is a publicly visible entry in both the GitHub repository and global DNS — it maps our subdomain to our hosting address, but contains no visitor data.

What this means for your privacy as a visitor:

Cloudflare's role in detail:

• Cloudflare operates the nameservers that ashikmuhammed.com delegates its DNS to. When your browser looks up our subdomain, it contacts Cloudflare's infrastructure.
• Cloudflare may log DNS query data including resolver IP addresses and query timestamps as part of standard network operations and security monitoring.
• Cloudflare is headquartered in the United States and operates globally. It processes data under its own Privacy Policy and maintains GDPR Standard Contractual Clauses for international data transfers.
• Cloudflare does not set cookies or run JavaScript on our website — its role is limited to the DNS layer, before your browser loads any page content.

About ashikmuhammed.com's operation and governance:

• ashikmuhammed.com is a community-run, non-commercial open-source project. It has no advertising model and does not sell data.
• The project is sponsored by Cloudflare's Project Alexandria program, which provides DNS infrastructure at no cost to the project.
• Subdomain registrations are subject to ashikmuhammed.com's Terms of Service. Subdomains hosting illegal content, malware, spam, or abusive material may be suspended or removed by the ashikmuhammed.com maintainers.
• ashikmuhammed.com's subdomain list is registered in the Public Suffix List (PSL), meaning browsers and platforms treat each .ashikmuhammed.com subdomain as its own isolated cookie and security scope — just like a top-level domain.
• If ashikmuhammed.com discontinues its service or removes our subdomain, the site will remain accessible via our direct Vercel URL.

Useful links:

• ashikmuhammed.com — official website
• Cloudflare Privacy Policy
• Cloudflare GDPR compliance information

How the blog works technically:

• Blog posts are stored in our MongoDB Atlas database and served via a Vercel serverless function at /api/blog — the same infrastructure that powers the contact form and visitor tracking.
• When you open a blog post, a view counter is incremented server-side. This counter stores only a number — it does not record who viewed the post, link your IP address to the post, or store any personally identifiable information.
• Blog pages are tracked by our standard visit analytics script in exactly the same way as all other pages on the site (see Section 03A). No additional tracking layer is applied to the blog.
• Tag filtering and pagination on the blog listing page (/blog.html) are handled entirely in your browser — no search terms or filter selections are transmitted to or stored by our servers.
• Share buttons (Twitter/X, LinkedIn) open a new browser tab using the platform's standard share URL. They do not load third-party scripts or tracking pixels on our page — no data reaches those platforms unless you actively click and complete the action on their site.

Blog data we store (server-side):

What we do NOT do on the blog:

• Require registration, login, or account creation to read any post
• Store comments or user-generated content (no comment system exists)
• Use advertising networks, affiliate trackers, or sponsored content pixels
• Record which specific visitor read which post
• Sell or share blog reading history with any third party
• Serve personalised content based on your identity or browsing behaviour

Admin access: Creating, editing, publishing, and deleting blog posts is restricted to the site owner (Ashik Muhammed) via the password-protected admin panel. All admin actions require a valid short-lived JWT token and are completely inaccessible to regular visitors.

Your data may only be shared in the following limited circumstances:

• Service providers — only the third-party services listed in Sections 07, 07B, and 07C, and only the minimum data required for their function
• Legal obligation — if required by a valid court order, law enforcement request, or applicable law
• Protection of rights — if necessary to prevent fraud or protect the rights of users

We do not share data with:

• Advertising networks or marketing platforms
• Data brokers or list vendors
• Social media platforms (blog share buttons do not load any third-party scripts)
• Any third party not listed in Sections 07, 07B, or 07C

When retention periods expire, data is permanently deleted from our MongoDB database. You may request early deletion at any time — see Section 12. For DNS-level data held by Cloudflare, please refer directly to Cloudflare's Privacy Policy.

• All data transmitted between your browser and our servers is encrypted via HTTPS / TLS
• Admin panel protected by username + password authentication with brute-force lockout (5 failed attempts → 15-minute block)
• All admin API routes — including blog create, edit, publish, and delete actions — require a valid JWT token; unauthenticated requests are rejected with a 401 error
• Public blog read endpoints are rate-limited to prevent scraping and abuse
• Input sanitisation on all form submissions and blog content fields to prevent XSS and injection attacks
• Rate limiting on contact form (3 submissions/hour per IP) and visitor tracking (30 requests/minute per IP)
• IP address masking — last octet hidden in admin display (e.g. 1.2.3.xxx)
• MongoDB Atlas provides encryption at rest and network isolation for all stored data including blog posts
• Vercel provides DDoS protection and a WAF (Web Application Firewall) at the CDN level
• The site is served via Vercel's global edge network, providing DDoS mitigation, TLS encryption, and performance optimisation at the infrastructure layer

This website uses no tracking cookies. We do not set advertising cookies, analytics cookies, or persistent cross-site tracking identifiers.

The following browser storage is used for functional purposes only:

Neither value contains personal information. The session ID is a random alphanumeric string with no link to your identity. Chat conversations (Fahmidha) are held only in browser memory and are never written to persistent storage. Blog tag filter selections and pagination state are also held in browser memory only — nothing is written to cookies or storage.

You have the following rights regarding your personal data. To exercise any of them, email ashikmuhammed@proton.me — we respond within 48 hours.

For data held by third-party services (Vercel, MongoDB Atlas, etc.), please contact those services directly using the links in Section 07. We do not control their data and cannot process deletion or access requests on their behalf.

This website is not directed at children under the age of 13 (or 16 in jurisdictions where that applies). We do not knowingly collect personal information from children.

If you believe a child has submitted information via our contact form or chat, please contact us at ashikmuhammed@proton.me and we will delete it promptly.

This website is operated from India. If you access it from the European Union, United Kingdom, USA, or another jurisdiction, your data may be transferred to and processed in India and the USA (where our cloud providers are hosted).

EU / UK users: You may have additional rights under GDPR or UK GDPR. Contact us to exercise them. Note that Vercel — which hosts this site — maintains GDPR compliance and Standard Contractual Clauses. See their privacy policy for details.

California users: You may have additional rights under CCPA. We do not sell personal information. Contact us for details.

Regarding Vercel: Vercel, Inc. is a US-based hosting provider. Data processed at the infrastructure level is subject to US-based data handling with GDPR-compliant transfer protections in place.

We may update this Privacy Policy to reflect changes in our practices, technology, or applicable law. When we do:

• The "Last updated" date at the top will change
• For significant changes, the version number will increment (e.g. v4.0 → v5.0)
• Continued use of the website after an update constitutes acceptance of the revised policy

Version changelog:

The current version is always available at ashikmuhammed.com/privacy-policy.

For any privacy-related questions, data requests, or concerns:

When emailing about your data, please include your IP address (find it at ipinfo.io) or the email address used in a contact form submission so we can locate your records.

For issues relating to Vercel hosting or MongoDB Atlas data, please contact those services directly — we do not have access to data held independently by their systems.