Analytics
I use StatCounter and PostHog to understand how visitors use this site. These services collect data like page views, visit duration, and IP addresses. I do not store this data myself - I view it through their dashboards for analytics purposes.
API & Security Logging
To protect against abuse and detect unauthorized access, my backend services automatically log the following when you make API requests:
- IP address - your public IP address at the time of the request
- Request data - the content of POST/PUT/PATCH requests (up to 10 KB)
- Request metadata - the URL path, HTTP method, response status code, and response time
How long is this data kept?
General request logs (IP address and raw request data) are kept for 90 days, then anonymized: the IP address and raw request body are removed, and only non-identifiable information remains - a short hash of the request body (which cannot be reversed to recover the original data), the URL path, HTTP method, status code, and response time. This anonymized data is kept for up to 180 days in total, then deleted.
Exception: if activity is flagged as abusive or malicious - for example vulnerability scanning, credential probing, subdomain enumeration, or request floods - the source IP address may be kept longer than 90 days, and for repeat or serious offenders indefinitely, for abuse prevention and investigation. Such IPs may also be reported to the relevant hosting/cloud provider and to public abuse databases.
Why is this collected?
This logging exists for two reasons. Security: detecting attacks and investigating abuse. And keeping the tools working: finding errors and fixing them, and seeing where people get stuck so I can improve things. For example, if I see repeated failed requests using a ticker symbol my API does not recognize, I add it as an alias; if a rate limit is turning away ordinary use, I raise it. I do not sell or share this data, and I do not use it for advertising or profiling.
Abuse Prevention
This site runs automated abuse detection. Suspicious traffic is detected automatically and the source IP may be blocked without notice. This is to keep free, open tools available for everyone. If you believe your IP was blocked in error, email me at amar@harolikar.com and I'll review it.
Prototype Applications
Some pages feature experimental web applications. These may temporarily store data you provide to function properly. This data is regularly cleared and is not permanently retained.
User Accounts & File Storage
Some applications (like DuckIt) allow optional sign-in via Google. If you sign in, your email address is stored to identify your account. Files you upload are stored on my server (24 hours for guests, 7 days for signed-in users) and automatically deleted after their retention period. Shareable links work like Dropbox - anyone with the link can download. I do not sell or share your data.
AI-Powered Features
Some features use AI or automated systems. Outputs are for demonstration and educational purposes only. Do not rely on them for critical decisions.
Cookies
This site uses cookies for basic functionality and analytics. You can disable cookies in your browser settings.
No Guarantees
This is a personal site, not an enterprise service. I make no guarantees about data security or handling. Use at your own discretion.
Changes
I may update this policy without notice.