Privacy Policy
Last updated:
This Privacy Policy explains how Yassine Boumiza ("we", "us", "our") collects, uses, and protects your information when you visit boumiza.com, any of its subdomains — including but not limited to clearpath.boumiza.com, nightwatch.boumiza.com, and editorinchief.boumiza.com — or interact with ExpressDelivery, our open-source mailbox application (together, the "Services"). By using the Services you agree to the practices described below.
1. Scope
This policy applies to all public-facing pages, admin interfaces, APIs, and companion applications operated under the boumiza.com domain and its subdomains, as well as to ExpressDelivery. Each Service may process additional categories of data specific to its function; material differences are described in the relevant Service-specific section below.
2. Information We Collect
We collect only what is necessary to operate the Services:
Contact form submissions: name, email address, subject, and message content, together with the IP address and user agent used to submit the form (for rate limiting and abuse prevention).
Authentication data (admin only): email address and a salted bcrypt password hash. We never store plaintext passwords.
Session data: short-lived authentication cookies and a CSRF token cookie, both HTTP-only where supported.
Analytics and crawler telemetry: aggregated counts of requests from known crawlers (Googlebot, GPTBot, ClaudeBot, Perplexity, and others), stored in AIOAnalytics for the purpose of understanding AI-assistant visibility. No personal identifiers are attached.
Failed-login audit data (admin only): email, IP, and user-agent of failed authentication attempts, retained for intrusion detection.
3. How We Use Your Information
To respond to contact form submissions and legitimate inquiries.
To authenticate administrators and secure the admin surface (rate limiting, account lockout, CSRF defense).
To publish content you voluntarily submit (e.g. suggestions, feedback) only with your explicit consent.
To analyze traffic patterns in aggregate and improve the Services.
To comply with applicable legal obligations.
4. Subdomains
The following subdomains operate under this same Privacy Policy with Service-specific notes:
clearpath.boumiza.com — a project-tracking workspace. Beyond the baseline collection above, ClearPath may store project names, task descriptions, and timestamps that you voluntarily enter.
nightwatch.boumiza.com — a monitoring and observability tool. NightWatch may store metric samples, log excerpts, and alert configurations that you submit.
editorinchief.boumiza.com — an editorial workflow application. EditorInChief may store draft articles, review comments, and publication schedules that you submit.
In every subdomain, data that you author is stored to enable the product function. Data is retained only as long as necessary to provide the Service and is deleted on account closure or upon written request.
5. ExpressDelivery (Open-Source Mailbox)
ExpressDelivery is an open-source mailbox application distributed under its stated license. When you self-host ExpressDelivery, YOU are the controller of any data it processes — not us. We do not receive copies of messages, contacts, or credentials from self-hosted deployments.
If you use a hosted instance of ExpressDelivery operated by us, we process message metadata (sender, recipient, timestamp, size), message bodies, attachments, and authentication tokens solely to deliver mail functionality. Message contents are encrypted at rest where technically feasible and are never used for advertising, profiling, or sold to third parties.
6. Cookies and Similar Technologies
We use a small set of strictly-necessary cookies: a session cookie for authenticated admin sessions, a CSRF token cookie, and a theme preference cookie. We do not set marketing, advertising, or cross-site tracking cookies.
7. Third-Party Services
Email delivery: transactional email (including contact form notifications) is sent via BREVO SMTP. BREVO processes sender and recipient addresses plus message content to deliver the email.
Hosting: the Services are hosted on a Hostinger VPS. Hostinger has access to server-level logs as required to operate the infrastructure.
No third-party analytics, advertising, or social-media trackers are embedded in the Services.
8. Data Retention
Contact form submissions are retained for up to 24 months to enable follow-up. Failed-login audit rows are retained for 90 days unless required longer by investigation. AIOAnalytics aggregates are retained indefinitely because they contain no personal data. Admin accounts are retained for the lifetime of the site unless explicitly closed.
9. Your Rights
Depending on your jurisdiction (e.g. GDPR, CCPA, PIPEDA), you may have the right to:
Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data, subject to legal retention obligations.
Object to processing or request restriction.
Data portability in a structured, machine-readable format.
Withdraw consent where processing is based on consent.
To exercise any of these rights, email privacy@boumiza.com. We aim to respond within 30 days.
10. Security
The Services implement defense-in-depth: nonce-based Content Security Policy, HMAC-signed CSRF tokens, bcrypt-cost-12 password hashing, rate limiting, account lockout, magic-byte file validation, OWASP-aligned security headers (HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy), AES-256-GCM with pinned authentication-tag length for any secret storage, and fail2ban at the VPS layer. No system is perfectly secure, but we apply industry-standard practices and address disclosed issues promptly.
11. Children
The Services are not directed at children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect data from minors. If you believe a minor has submitted data to us, contact privacy@boumiza.com and we will delete it.
12. International Transfers
Our hosting and email-delivery providers are located outside Canada. Your data may be transferred to, stored in, and processed in other jurisdictions. We rely on contractual safeguards with our providers to protect your data during such transfers.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced on the main site, and the "Last updated" date at the top of the public page will reflect the revision. Continued use of the Services after an update constitutes acceptance of the revised policy.
14. Contact
For privacy questions, data subject requests, or complaints, contact: privacy@boumiza.com. For security disclosures, use security@boumiza.com.