Privacy Policy
Last updated: July 2026
This Privacy Policy applies to all websites within the Zulfanoon ecosystem, including zulfanoon.com and all subdomains (calc, auth, tools, devtools, ai, prompts, craftcv, downloader, bgremover, qr, tempmail, admin). We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable privacy laws.
1. Information We Collect
We collect the following types of information:
Account Data
When you register at auth.zulfanoon.com, we collect your email address and name. Passwords are stored as bcrypt hashes and never in plain text.
Usage Data
We collect the following usage data across all Zulfanoon sites:
- Pageviews: Pages visited, time spent on each page, scroll depth, viewport size
- Click tracking: Click coordinates (x/y percentage), clicked element (tag, text, ID), for UX analysis
- Session data: Session duration, landing/exit pages, pages per session
- Device info: Browser name and version, OS name and version, and device type (desktop, mobile, tablet) parsed from your browser's User-Agent string
- Network info: IP address (stored in full for analytics and security). IP addresses are resolved to country and city via ip-api.com for geographic analytics. No API key or personal data is shared with ip-api.com beyond the IP address itself.
- Referrer: The URL that brought you to our site
Usage data is collected only after you provide consent via the cookie consent banner. Without consent, no analytics data is collected.
Local Storage & Session Storage
We use browser local storage to persist a anonymous visitor identifier (survives browser restarts) and session storage to track your current browsing session. These are used solely for analytics and do not contain personally identifiable information.
Cookies
We use cookies and similar technologies for authentication, security, analytics, and advertising. See section 4 for a detailed cookie table.
2. Temp Mail Service (tempmail.zulfanoon.com)
The Temp Mail Service is ephemeral by design. It collects no accounts, names, or passwords. Mailboxes are bound to your browser by a functional cookie (tempmail_mb) and expire after 24 hours of inactivity. All messages are permanently deleted when the mailbox expires; there are no backups. The service also stores rate-limit counters per IP (1-hour rolling window, in Redis) and, only after you consent via the cookie banner, analytics data (pageviews, clicks, sessions, device info, IP → country/city, retained for 24 months). Server logs (IP, user-agent, timestamp) are retained for 30 days. The Temp Mail Service has its own Service-Specific Privacy Policy with additional details.
3. How We Use Your Information
Across all Zulfanoon sites (including Temp Mail), we use your information to:
- Provide, operate, and maintain our services
- Authenticate your account and keep you logged in across subdomains
- Analyze usage patterns to improve our tools and user experience
- Display relevant advertising via Google AdSense (where enabled)
- Protect against fraud, abuse, and security threats
- Communicate with you about your account and service updates
- Comply with legal obligations
4. Legal Basis for Processing (GDPR)
Under the GDPR, we process your personal data on the following legal bases:
- Consent: When you register an account or accept non-essential cookies
- Contract: To provide the services you requested
- Legitimate Interest: For analytics, security, and service improvement
- Legal Obligation: To comply with applicable laws and regulations
5. Cookies
The table below lists the cookies we use, their purpose, and duration:
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
jwt |
Authentication token (keeps you logged in) | 24 hours | Essential |
jwt-refresh |
Refresh token for session renewal | 7 days | Essential |
csrftoken |
Protects against cross-site request forgery | Session | Essential |
zv_consent |
Stores your cookie consent choice | Until cleared | Functional |
zv_id (local storage) |
Anonymous visitor identifier for analytics | Until cleared | Analytics |
zv_session (session storage) |
Current browsing session identifier | Tab close | Analytics |
_ga, __gads |
Google AdSense advertising personalization | 13 months | Advertising |
You can disable non-essential cookies in your browser settings. Essential cookies are required for the service to function and cannot be disabled.
6. Third-Party Services
We use the following third-party services that may process your data:
- Google AdSense. Displays ads and uses cookies to personalize advertising. See Google's Advertising Cookies Policy.
- Cloudflare. CDN and DDoS protection. May process IP addresses for security purposes. See Cloudflare's Privacy Policy.
- ip-api.com. Resolves IP addresses to approximate country and city for analytics purposes. No personal data beyond the IP address is shared. ip-api.com does not store or retain our queries. See ip-api.com Legal.
7. Data Retention
We retain your data for the following periods:
- Account data: Until you request deletion (see section 13)
- Analytics data (visitors, sessions, pageviews, clicks): 24 months from collection, then automatically purged
- Server logs: 30 days
- Database backups: 30 days
8. Data Security
We implement industry-standard security measures to protect your data:
- HTTPS encryption for all data in transit
- Bcrypt hashing for all stored passwords
- JWT tokens for authentication (never stored in plain text)
- Non-root Docker containers for application isolation
- Restricted staff access with role-based permissions
- Regular database backups
- PostgreSQL and Redis not exposed to the public internet
9. Your Rights: GDPR (EU/UK)
Under the GDPR, you have the following rights regarding your personal data:
- Right of Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Data Portability: Receive your data in a machine-readable format
- Right to Restrict Processing: Limit how we process your data
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time (for consent-based processing)
To exercise these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
10. Your Rights: CCPA (California)
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you additional rights:
- Right to Know: Request disclosure of the personal data we collect about you
- Right to Delete: Request deletion of your personal data
- Right to Opt-Out of Sale: We do not sell your personal data, so no opt-out is required
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights
To exercise these rights, email [email protected].
11. Children's Privacy
Our services are not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe we have collected such data, please contact us at [email protected] and we will promptly delete it in compliance with COPPA and similar regulations.
12. International Data Transfers
Our services are hosted on servers located in the European Union (Contabo EU region). Your data is processed and stored within the EU. Where third-party services (such as Google AdSense or Cloudflare) may transfer data outside the EU, appropriate safeguards such as Standard Contractual Clauses (SCCs) are in place to ensure GDPR-compliant protection.
13. Advertising & Opt-Out
We may display ads served by Google AdSense. Google and its partners use cookies to serve ads based on your visits to our site and other sites on the internet. You can opt out of personalized advertising by:
- Visiting Google Ads Settings
- Visiting Digital Advertising Alliance opt-out
- Disabling advertising cookies in your browser settings
Third-party vendors, including Google, use cookies (such as the DART cookie) to serve ads based on your prior visits to this website and other websites. Google's use of the DART cookie enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the Internet. You may opt out of the use of the DART cookie by visiting the Google Ads Settings page. For more information on how Google uses data when you use our site, see How Google uses information from sites or apps that use its services.
14. Account Deletion
You can request deletion of your account and associated personal data at any time by:
- Visiting your profile page (if account deletion is available)
- Emailing [email protected] with the subject "Account Deletion Request"
We will process your request within 30 days and permanently delete your personal data. Some anonymized analytics data may be retained as permitted by law.
15. Changes to This Policy & Contact
We may update this Privacy Policy from time to time. Material changes will be notified by email (to registered users) or by a prominent notice on our website. We encourage you to review this page periodically.
For privacy-related inquiries, account deletion requests, or to exercise your data protection rights, contact us at [email protected].