Privacy policy
Draft for business and appropriate legal review. Prepared 30 October 2026. This describes the current implementation; it is not a claim of legal compliance.
Who to contact
Aana publishes this website. For privacy questions, requests to access or delete information, or newsletter removal, email contact@aanaa.tech. The operator’s legal name, public business address, target markets and applicable jurisdiction still require owner confirmation.
Information and purposes
- Contact form: your name, email address and message are sent through Resend to Aana to respond to your enquiry.
- Accounts: name, email, hashed password for email registration, account creation date and authentication records are stored in the configured PostgreSQL database through Prisma. Google sign-in can supply your name, email, profile image and provider tokens.
- Community: comments and replies are associated with your account; your display name, avatar and comments appear publicly. Bookmarks and profile reading lists require your signed-in account or administrator access.
- Newsletter: your email, subscription date and active status are saved when you request updates. Unitpost delivers newsletter emails. Each newsletter includes an unsubscribe link and one-click unsubscribe header; you can also ask Aana to remove you using the contact email. Campaigns require verified subscriber opt-in and a tested production unsubscribe route before activation.
- Hosting and media: Vercel and image providers receive technical request information such as IP addresses and requested resources. Cloudinary hosts uploaded images. Third-party news links lead to other websites with their own practices.
Cookies and browser storage
Essential authentication cookies maintain sessions and protect sign-in requests. The theme preference is stored by the theme provider. The localStorage key aana-consent-v1 remembers your analytics choice. Session storage holds a non-personal confirmation flag after a successful form submission. None of these flags contains your form values.
Optional analytics and advertising
Google Analytics loads only after you select Accept analytics. It receives public page paths and fixed events for article exploration and successful contact, subscription or email signup actions. Form values, search queries, reset tokens and private routes are excluded from our events. Google may process device, network and cookie identifiers; we do not describe this as anonymous. The owner must disable enhanced automatic collection in the Analytics account as described in the project audit.
Use Cookie preferences in the footer to reject analytics or withdraw a previous choice. Withdrawal disables collection, clears accessible first-party analytics cookies and reloads the page. Cookies on third-party domains cannot be removed by this site. Ads and Vercel Analytics are disabled in this implementation. Advertising requires a separately reviewed consent platform before reactivation.
Other services and editorial tools
Project integrations include Google OAuth, Google Analytics, Resend (contact and account messages), Unitpost (newsletters), Vercel, Cloudinary, external RSS/image sources, and editorial AI services including Google Gemini and Groq. Editorial tools are intended for public content; contact messages and passwords are not sent to them by these forms. The database host, processor agreements, international transfers and provider retention settings require owner review.
Retention, requests and security
The owner has not supplied retention periods for accounts, messages, logs, subscriptions or backups. These periods and deletion procedures must be decided and documented. Contact Aana to request access, correction, deletion or withdrawal from updates; available rights and response obligations depend on the applicable rules. Passwords are hashed and authenticated routes restrict access, but no service can guarantee complete security.
Before publication as a final policy
Confirm the operator details, retention schedule, database hosting, target markets, newsletter verification/unsubscribe procedure, cookie inventory after deployment, and any additional processing outside this codebase. Review this draft whenever integrations change.