Privacy

Vitae is Eshaan Mehta’s personal website. The public pages — writing, projects, resources and the reading list — are open to anyone. Everything behind the sign-in is a private workspace with exactly one account, mine. There is no sign-up, and nobody else’s data is in it.

Nothing that identifies you. There is no analytics, no tracking pixel and no advertising code anywhere on this site. Fonts, logos and book covers are served from this domain rather than from a third party, so reading a page here does not report you to one.

Two things worth stating plainly:

• Vercel hosts the site and keeps ordinary server logs, which include IP addresses and user agents. Those are Vercel’s, retained under their policy, and used to serve and secure the site.
• The newsletter box in the footer is not connected to anything yet. What you type there stays in your browser and is not sent or stored.

The signed-in area holds my own tasks, calendar, habits, journal, gratitude notes and finances, in a Supabase Postgres database with row-level security scoped to my account. Sign-in is a username and a eight-digit PIN; the PIN itself is never stored.

When I connect Google Calendar, the app asks Google for two permissions:

• https://www.googleapis.com/auth/calendar — to read and write events on my calendar, which is what the calendar page shows and edits.
• https://www.googleapis.com/auth/userinfo.email — to show which Google account is connected.

The resulting access and refresh tokens and the Google account email are stored in the same Supabase database and used only to make those calendar requests on my behalf. They are never shared, sold, used for advertising, or used to train any model. Disconnecting in Settings revokes the token with Google and deletes the stored row.

Google user data obtained through these scopes is used only to provide the calendar feature in this app, in line with the Google API Services User Data Policy, including its Limited Use requirements.

Only while I am signed in, and only for the feature named:

• Open-Meteo — the weather forecast for my approximate location.
• ipwho.is and BigDataCloud — turning an IP address or coordinates into a city name for that forecast. Coordinates are rounded before they are sent.
• Stooq — market index quotes on the dashboard.
• Meta’s Instagram Graph API — analytics for my own Instagram account.
• Anthropic — only if I add my own API key, and only for the prompt tool.

Any data belonging to other people. There is no registration, no comment system, no form that stores what you type, and no third-party advertising or analytics on any page.

Workspace data stays until I delete it. Google Calendar tokens are deleted as soon as I disconnect the integration.

Questions about this policy: eshaantm@gmail.com