Privacy notice
Last updated: 22 October 2026
> who we are
This site is run by Cipher Shinobi. We're based in the United Arab Emirates. We decide what happens to what you send, so in data protection law we're the "controller".
Write to privacy@ciphershinobi.com about anything in this notice.
> when you press Transmit
The line above the Transmit button says you agree to this policy. Under UAE law, that is your consent to three things: that we read your message and use it to reply to you; that our providers hold it outside the UAE, as described under "where it goes"; and that we keep it for the time described under "how long". You can withdraw your consent at any time by emailing privacy@ciphershinobi.com, and we'll delete your message. Under UK law we don't rely on your consent; our reasons are set out under "what we do with it, and why".
> what we collect
From the form, only what you type:
- who sent you, if you choose to say;
- your name, or any name you answer to;
- how to reach you: an email address or a phone number. We need one, or we can't reply;
- what you're building, in up to 1,500 characters.
If you tell us who sent you, we keep that name with your message as context for our reply, and for nothing else. We never contact them because of it, and we delete it with your message. Please only name people who are happy to be named. The same goes for anyone else you name, such as an assistant we should reply to.
Please don't send health, financial or other sensitive details. A sentence about the project is enough.
When the page loads, our host records what any web server needs to deliver a page and stop abuse: your IP address, the time, the page requested and your browser's name. We keep nothing else about your visit.
If you write to us by email instead of using the form, we handle what you send in the same way.
> what we do with it, and why
| What we do | Why | UK law basis | UAE law basis |
|---|---|---|---|
| Read your message and reply to you | To answer you. A person reads every message and decides every reply. | Our legitimate interest in answering people who write to us. If you're asking about working with us yourself, steps you've asked us to take before a contract | Your consent, given when you press Transmit (see "when you press Transmit") |
| Host records, the spam check and the rate limit | To deliver the page and keep the form free of abuse | Our legitimate interest in a secure site | Kept to the minimum needed to serve the page, and deleted quickly (see below) |
If we end up working together, your message joins our client file under a separate agreement, which explains how we use it then.
We don't sell your information. We don't use it for marketing or add you to a mailing list, and we don't profile you. No decision about you is made by automated means alone.
Where we rely on legitimate interests, we've weighed them against your interests and rights. Ask us and we'll explain.
> who else sees it
Services that act on our instructions, under data processing terms:
- Vercel Inc. (United States), which hosts this page and runs the form;
- Google LLC (United States), which runs our email.
And anyone the law requires us to tell.
> where it goes
We work from the United Arab Emirates. Vercel runs the form in the United States. Google keeps our email in its data centres in the United States and other countries.
For Vercel and Google, data leaving the UK is protected by the UK's International Data Transfer Addendum in their terms, or by the UK–US data bridge where a provider is certified.
Their holding it outside the UAE is part of the consent you give when you press Transmit.
> how long
- A message that doesn't lead to working together: deleted 12 months after our last exchange, together with the name of whoever sent you. Our email provider can restore a deleted message for up to 55 days; after that it is gone for good.
- A message caught by our spam check: deleted after 7 days.
- Host records: kept by our host for 1 day, and never more than 30 days.
- If we work together: kept with the client file for six years after the work ends.
> your rights
You can ask us to:
- send you a copy of what we hold about you;
- correct it;
- delete it;
- restrict or stop how we use it, or object to our using it;
- give you what you sent in a form you can take elsewhere, where that applies.
Under UAE law you can also withdraw your consent at any time. The simplest way is to ask us to delete your message.
Email privacy@ciphershinobi.com. We'll reply within one month. If a right has an exception that applies, we'll say which and why.
> complaints
Tell us first, at privacy@ciphershinobi.com. We'll acknowledge your complaint within 30 days and tell you what we did about it.
In the UK you can also complain to the Information Commission (the ICO): ico.org.uk/make-a-complaint.
In the UAE you can complain to the federal authority responsible for data protection, now the Federal Authority for Artificial Intelligence and Data.
> cookies
None. This site sets no cookies and stores nothing on your device.
To draw itself, the page asks your browser two things: whether you prefer reduced motion, and what kind of screen and pointer you're using. The answers stay on your device and are never sent to us. Your reduced-motion setting is always respected.
No analytics. No tracking. No third-party scripts, fonts or requests.
> changes
If this notice changes, the date at the top changes with it.