Privacy Policy

Who we are

Codomain is run by Sagar Raturi, an individual based in New Delhi, India. In this policy, “Codomain”, “we” and “us” mean them. For anything about your data, write to contact@codomain.in.

If you have a Codomain account

We store:

• Your email address, to sign you in and to send you account email: address confirmation and password resets.
• Your password, only as a one-way hash (Argon2). We cannot read it.
• Your display name, bio and profile photo, which appear publicly on your blog because that is what they are for.
• Your blog and everything you write in it, drafts included. Drafts are never shown to anyone but you.

Your email address is not shown on your blog unless you switch that on in Settings. When the switch is off, it never leaves our servers.

If you subscribe to a blog

When you subscribe to a blog hosted on Codomain we store your email address, which blog it is for, whether you have confirmed, and when you subscribed, confirmed or left. We use it for one thing: emailing you when that blog publishes a post.

• Nothing is sent until you click the link in the confirmation email.
• Every email has an unsubscribe link that works in one click, with no login.
• The writer of the blog can see your address and export their subscriber list. They are responsible for how they use it once it leaves Codomain.
• If you unsubscribe, or an email to you bounces or is marked as spam, we keep a record of that so we never email you again from that blog — or, after a bounce or spam report, from any blog on Codomain.

Cookies

Published blogs set no cookies for readers. The Codomain website and dashboard use three, all strictly necessary:

• sessionid keeps you signed in. It cannot be read by scripts on the page.
• csrftoken protects your account against forged requests from other sites.
• postly_auth says only whether you are signed in, so the site knows whether to show you the dashboard. It holds no identity.

Your light or dark mode choice for the Codomain website is saved in your browser, not sent to us. We use no analytics, advertising or tracking cookies, so there is no cookie banner to dismiss.

Who else handles your data

We do not sell or rent personal data, and we do not share it for advertising. A few services run parts of Codomain for us and process data only to do that:

• Vercel hosts the website and published blogs.
• Render hosts the application server and database.
• Resend delivers email: account messages and posts sent to subscribers.

These providers may store and process data outside India, including in the United States. Like any website, their servers keep short-lived technical logs, such as IP addresses, to keep the service running and secure. We may also disclose data where the law requires it.

How long we keep it

• Your account: until you delete it. You can do that any time from Settings, and your account, blog, posts and subscriber list are removed immediately. Copies in backups are overwritten as backups roll over.
• A subscription: until the blog is deleted, apart from the record that keeps an unsubscribed or bounced address from being emailed again.

Your rights

Wherever you live, you can ask us what we hold about you, have it corrected or deleted, or get a copy of it. Writers can delete their account themselves in Settings; subscribers can leave through any email’s unsubscribe link. For anything else, email contact@codomain.in and we will answer within 30 days. If you think we have mishandled your data, you can also complain to the data protection authority where you live.

Children

Codomain is not meant for anyone under 18, and we do not knowingly hold their data. If you think a child has signed up, tell us and we will delete the account.

Changes to this policy

If we change this policy, we will update the date at the top of the page. If a change affects how we use data we already hold, we will tell account holders by email before it takes effect.