Privacy, in plain language.

The public library

The public pages are served through Amazon S3 and CloudFront. Reading lessons does not require an account. Learning progress and theme preferences remain in your browser.

Optional site measurements

Optional measurement code is included so I can learn which pages and lessons are useful. Collection only starts when the measurement service is available, enabled, and you choose to allow it. If the service is unavailable or you decline, the library continues to work without these measurements. Global Privacy Control and the owner exclusion setting turn collection off.

With permission, a random first-party browser identifier and a session identifier are stored locally. I collect registered page paths, referring domains, allowlisted campaign categories, broad device and browser categories, selected interaction counts, scroll milestones, and bounded active-time updates. I do not collect form values, arbitrary search queries, full referrer URLs, URL fragments or unrestricted query strings in analytics. There is no fingerprinting. Average active time is an observation of a visible page with recent activity, not exact human attention.

The consent preference lasts 90 days. You can change it using Measurement choices in the footer. Turning measurements off clears the measurement identifiers in this browser. Default analytics retention is 90 days and can be shortened. Identifiers can represent multiple devices or be cleared, so visitor counts do not mean exact people.

Website inquiries

When the website inbox is available, the contact form stores your name, email, optional company, topic, message and the page from which you opened contact. A success message is shown only after storage is confirmed. I use this information to review and reply to your inquiry. Inquiry records are private to the authorized owner. Default retention is 365 days, with deletion available to the owner.

Direct email and LinkedIn messages stay in those services. They do not automatically appear in the website inbox. No reply is sent automatically on my behalf.

Owner access

Owner sign-in, when available, uses Amazon Cognito sign-in with MFA and owner authorization. It has no public registration. Short-lived session cookies are Secure, HttpOnly and SameSite; bearer tokens are not kept in browser local storage. Private API responses are not cached.

Hosting and retention

Cloud services necessarily receive network information while serving a request. The measurement database does not store raw IP addresses. Short-lived keyed abuse counters are separate from analytics. Application diagnostic logs contain failure categories rather than inquiry contents or tokens, with a 14-day retention configured for the new service. The site account was checked on 12 October 2026: CloudFront standard and real-time access logging and S3 server-access logging were off. The API has execution logging and body tracing disabled. This does not mean AWS processes no operational or security metadata.

Expired data is excluded from application reads. Physical expiry is asynchronous. Recovery backups can retain deleted records for the provider's backup window; a restore must reapply expiry and deletion controls before access is opened.

LinkedIn publishing

The "Khalid Shams" LinkedIn application is a private tool I use to publish my own posts to my own LinkedIn profile. It does not access, store or process any other member's data.

Questions or deletion requests

Email me about your inquiry or privacy choices. Please provide enough context to identify your submission without sending additional sensitive information.

Last updated October 2026.