Pending legal review. This is an honest draft, not legal advice, and not yet the company’s adopted policy.

Privacy

Serendib sends a weekly digest and, later, a read-only index you can ask from Claude. This notice describes what we expect to collect. It is a draft. A lawyer has not signed it. Do not treat it as the company’s adopted policy.

What we expect to hold

• An email address, if you subscribe, plus the time you confirmed it and the time you unsubscribe.
• The beat you are on. In the first version there is one beat, so the choice is not meaningful yet.
• Feedback you give on a connection (useful, knew it, noise), tied to a signed token, not to a public profile.
• A pilot request, if that form is switched on later: name, work email, organisation, role, team size, beat interest.
• Ordinary server logs: IP address, user agent, path, status. We do not intend to use these for advertising.

We do not sell subscriber data. We do not train models on subscriber data. We do not put tracking pixels in the email. Opens, if we look at them at all, would be aggregate figures from the email provider.

Why

The legal bases we expect to rely on, once counsel confirms them, are consent (the double opt-in) and legitimate interest in running the service you asked for. EU subscribers are covered by the GDPR. People in Sri Lanka are covered by the Personal Data Protection Act, No. 9 of 2022. This draft is written so both can be honoured. It is not a filing under either law.

How long

Unconfirmed addresses should be deleted after 7 days. Feedback and delivery records stay while the archive needs them to be honest. You can ask for export or deletion. We intend to answer within 30 days. The address for that request is privacy@serendib.tech. That mailbox may not be monitored until the company is registered. Until then, write to the founder through the site when a contact path exists, and do not send passwords or identity documents.

Cookies and analytics

The public site is meant to use Plausible, which does not set a cookie and does not need a consent banner. Session replay and advertising pixels are out. The theme choice is stored in localStorage on your machine. It is not sent to us.

Processors

Email is expected to go through Resend. The site runs on Railway, the domain’s DNS is hosted by Hostinger, and forms use Cloudflare Turnstile to tell people from bots. Those names describe the setup, not a claim that a data-processing agreement is signed.

Children

Serendib is not for children. We do not knowingly collect data from anyone under 16.