advay

Privacy

What this site keeps about you, why it keeps it, who else can see it, and what is done to keep it safe. Written to be read, not to be skipped.

Last updated 27 October 2026

The short version

This is a personal site, not a company. To let you have an account it stores your username, your email and a scrambled form of your password. It stores nothing else about you unless you choose to add it — a photo, a blog post, a comment.

There are no analytics, no advertising, no trackers, no fingerprinting, and nothing is ever sold or shared for marketing. One cookie exists, and it is the one that keeps you signed in.

What is collected, and why

Everything below is in the database because a feature needs it. If a feature did not need it, it is not there.

What	Why it exists	How long
Username and email	So you can sign in, and so a password reset can reach you.	Until you delete your account.
Password	Stored only as a PBKDF2-SHA256 hash with your own random salt. The password itself is never written down anywhere.	Until you change it or delete the account.
Six-digit codes	To prove the email is yours when signing up, resetting a password or changing your address.	Five to ten minutes, then deleted. Wrong guesses are capped at five.
Sign-in records — time, IP address, browser and device string	So your account page can show you where you are signed in, and let you sign out a device you do not recognise.	30 days, then they expire.
Profile photo (optional)	Shown on your posts and in the menu if you upload one.	Until you remove it or delete the account.
Blog posts and comments	They are the point of the blog. They are public, and they carry your username.	Until you delete them, or the account.
Apps you register for "Sign in with advay" (owner only)	So the site can tell your app apart from anyone else's.	Until you delete them.
Rate-limit counters	To slow down password guessing and spam. Each counter is tied to the connection it came from.	About a day after the window closes.

What is never collected

No phone number, no postal address, no date of birth, no government ID.
No card or payment details — nothing on this site costs money.
No analytics, no session recording, no heat maps, no advertising pixels.
No location tracking. No coordinates, no movement history, nothing beyond what any ordinary web request carries.
No data is sold, rented, or handed to anyone for marketing. Ever.

Cookies and local storage

There is exactly one cookie: advay_session. It holds your signed-in session, it is marked HttpOnly so scripts cannot read it, Secure so it only travels over HTTPS, and SameSite=Lax. It lasts 30 days, and signing out deletes it. There are no third-party cookies on this site.

Two things are kept in your browser's local storage, and they never leave it: your light/dark theme choice, and your best Sudoku times. Clearing your browser data removes both, and nothing breaks.

How it is protected

These are not promises, they are things the code actually does:

Passwords go through PBKDF2-SHA256 with 100,000 iterations and a unique random salt per person, and are compared in constant time so a wrong guess cannot be timed. A stolen copy of the database does not hand over passwords.
Sessions are a 144-bit random id in a signed cookie, and the server keeps the record — so a session can actually be revoked. The page never shows the id itself, only a short fingerprint of it.
Transport is HTTPS everywhere, with HSTS set so a browser refuses to fall back to plain HTTP.
Your browser is told, on every page, what it may load: a strict Content-Security-Policy, framing refused, content types pinned, referrers trimmed.
Cross-site requests are rejected by checking the origin on every request that changes something, backed up by SameSite on the cookie.
Guessing is slowed everywhere it matters — sign-in, sign-up, password reset, code entry, comments and posts all have their own limits.
Codes come from a cryptographic random generator, work once, expire in minutes, and stop after five wrong tries.
Access is checked per action: every database query is parameterised, and editing or deleting something verifies it is actually yours.
Keys live in the server's environment variables, never in the code, and the repository is set up so a stray secrets file cannot be committed by accident.
Nothing extra is collected, which is the cheapest protection there is: data that does not exist cannot leak.

What you can do

Everything below lives on your account page, without asking anyone:

Change your password — this signs out every other device at the same time.
Change your email address, confirmed by a code sent to the new one.
Upload or remove your photo.
See every device you are signed in on, and sign out any of them — or all of them.
Delete your account. That removes the account, its sessions, its apps, its posts, its comments and the comments other people left on those posts. It cannot be undone.

If you want a copy of what is stored about you, or something is wrong and you cannot fix it yourself, write to the address below and it will be sorted out.

How long things last

Thing	Lifetime
Sign-up code	10 minutes
Password-reset and email-change codes	5 minutes
Unfinished sign-ups	Deleted once the code is used, or abandoned
App sign-in codes	5 minutes, single use
App refresh tokens	60 days, replaced on every use
Sessions	30 days
Rate-limit counters	About a day after the window closes
Posts, comments, photo	Until you delete them

Children

This site is not meant for anyone under 13. If you are under 18, please use it with a parent or guardian knowing about it — especially before posting anything public.

Changes to this page

If what is collected or who sees it ever changes, this page changes with it and the date at the top moves. Nothing here is quietly rewritten — the site's source is versioned, so every edit to this page has a timestamp on it.

Contact

Questions, a data request, or something that looks wrong: advay1100@gmail.com

This is one person's site, so replies come from one person. Expect a real answer rather than a ticket number.

Written for advay.pages.dev. It describes what the code on this site actually does — if the two ever disagree, the code is the bug and this page gets fixed.