Privacy policy.
Last updated: 16 May 2026
This policy describes what data aliyosef.online collects when you visit the site, sign up for an account, enroll in a course, hire the studio, or subscribe to the newsletter. It is written in plain English (Arabic in parallel) — no legal-trap clauses, no buried opt-outs.
01Who we are
aliyosef.online is operated by Ali Haitham Yosef as a sole engineering studio based in Syria. The site is hosted on a dedicated VPS in Germany (Contabo) behind Cloudflare. All references to "we", "us", and "our" in this policy mean the studio.
Contact: [email protected] for any data request, [email protected] for general questions.
02What we collect
Account data: email address, name (if you provide one), Argon2id-hashed password, role assignments, and a list of which devices are signed in.
Course + service data: enrollments, quiz scores, lesson progress, certificates issued, project codes, milestones you have access to, invoices addressed to you, and support tickets you have opened.
Affiliate data: referral codes you created, click logs (with sha256-hashed IPs — never raw), conversions, and payout records.
Newsletter: email address and the double-opt-in confirmation token.
Contact form: name, email, enquiry type, message body, and the IP address from which it was submitted (kept 90 days for spam analysis, then deleted).
Analytics: every page view records a path, a sha256-hashed IP, the user agent string, the referrer host (only the hostname, never the full URL), and an event name. We never record query strings, form contents, or session cookies in analytics.
03What we never collect
We never store your raw IP address in analytics — only a one-way sha256 hash. We cannot reverse it.
We never read the contents of your private messages, support tickets, or files you upload to your project workspace, beyond what is needed to render them back to you.
We never sell your data, share it with advertising networks, or use it to train AI models.
We do not embed third-party trackers (no Facebook pixel, no Google Ads tag, no Hotjar) on the public site. The only third-party requests served from the public site are Cloudflare (DDoS protection + CDN), Google Fonts (CSS), and Fontshare (CSS) — none of which see your account data.
04How we use your data
To provide the service you signed up for — render the right pages, track your progress, issue your certificates, process your invoices, route your support tickets.
To send you transactional emails: verification codes, password resets, course enrollment confirmations, invoice notifications, ticket replies. These are not promotional; they are essential to the service.
To send you the newsletter, if and only if you double-opted in. Every newsletter has a one-click unsubscribe in the footer.
To analyze aggregate site usage (top pages, signup conversion, top referrers) so we can improve what is broken — never to profile individual users.
To prevent abuse — rate limiting and IP-hash matching catch spam and brute-force login attempts.
06Third parties we use
Cloudflare — DDoS protection, CDN, DNS. Cloudflare sees your IP address as the origin of the request. Their privacy policy is at cloudflare.com/privacypolicy.
Titan Email (Hostinger) — outbound transactional mail. Your email address is in the To: header.
Stripe — payment processing for paid courses and service invoices. Stripe handles your card data directly; we never see card numbers.
Google Fonts + Fontshare — font CSS only (no analytics, no tracking).
Vercel / Cloudflare Workers (for tenant storefronts on Mohaseb, not the public studio site) — edge rendering.
These are the only third parties. We add no others without updating this policy and dating the change.
07Your rights
Access: email [email protected] with the email address on your account and you will receive a complete dump of every row in our database that references your account, within 7 days.
Correction: edit your profile from /portal/student/account/profile, or email us if a field is not editable.
Deletion: request account deletion from /portal/student/account/danger or by email. We delete your account, your enrollments, your messages, and your analytics events within 14 days. Invoices and tax records are retained for 7 years per accounting law, with PII redacted.
Portability: along with the access request, you can ask for a JSON export of all your data. We will deliver it as a downloadable archive.
Opt-out: every newsletter email has a one-click unsubscribe. Transactional emails cannot be opted out of while you have an active account, because they are essential to the service.
08How we protect your data
Passwords are hashed with Argon2id (no MD5, no SHA, no fast hashes).
All connections to the site use TLS 1.2 or 1.3.
Sensitive columns (SMTP passwords, OAuth secrets, Stripe keys) are encrypted at the application layer.
Database backups are encrypted at rest and rotated daily.
Server access requires SSH key + per-engineer audit log.
In the event of a breach affecting your data, we will notify you by email within 72 hours and disclose the scope publicly on /status.
09How long we keep your data
Account data: as long as your account is active, plus 30 days after deletion to allow recovery if you change your mind.
Invoices: 7 years per tax law, with PII redacted after the account is deleted.
Analytics events: 24 months, then aggregated to monthly summaries and individual rows deleted.
Contact form submissions: 12 months unless converted to a service engagement.
Audit logs: 7 years for compliance, then deleted.
10Children
The site is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has signed up, email [email protected] and the account will be deleted within 24 hours.
11Changes to this policy
When we change this policy, we will update the "Last updated" date at the top and post a notice on /changelog. For material changes affecting how we process your data, we will email all active accounts at least 30 days before the change takes effect.