Privacy Policy

1. Who is responsible for your data

Sefism is operated by Tauseef Fayyaz, an individual based in Lahore, Pakistan ("Sefism", "we", "I"). I am the data controller for everything described below.

For any privacy question, correction, or deletion request, email support@sefism.com. I aim to respond within 30 days.

2. What we collect

Only what the platform actually needs to work. There is no advertising network, no data broker, and nothing is sold.

Why the IP address and user-agent on messages: they are kept solely to detect and block automated abuse of the public forms. They are not used to profile you.

3. Why we use it

• To create and operate your account, and to authenticate you.
• To read and personally reply to the questions and projects you send.
• To arrange, confirm, move and remind you about the sessions you book, and to create the meeting link for them.
• To run the learning side of the account: roadmaps, courses, quizzes, build tracks, and the credentials issued when work is finished.
• To review early access applications, and to verify a university email address when one was given. Your study details, if you share them, also help shape your roadmap.
• To keep track of what your credits unlocked, and to add credits when a contribution you sent is accepted.
• To display your public profile, but only if you switch it on (see section 6).
• To send transactional email: replies, verification, session confirmations and reminders, notifications you opted into.
• To understand which pages are used, in aggregate, so the site can be improved.
• To protect the platform: rate limiting, bot checks, spam prevention, and abuse investigation.
• To fix bugs and understand what is broken.

The legal bases, where the GDPR or UK GDPR applies to you, are: performance of a contract (running your account, arranging a session you asked for), legitimate interests (security, abuse prevention, replying to you, measuring traffic), consent (optional marketing email, public profile publication, being quoted).

4. Who processes it on our behalf

Sefism is a small operation built on third-party infrastructure. Each of these providers processes some of your data:

We do not sell your personal data, and we do not share it with advertisers. We disclose it only to these processors, or where we are legally required to.

Our Discord community is operated by Discord Inc. under its own privacy policy. Anything you post there is governed by Discord, not by this policy.

The Share menu on roadmaps, cheat sheets, questions, project ideas, resources and project structures loads no sharing scripts. Choosing LinkedIn, X, WhatsApp, Facebook or email opens that service with the page link, and only then; what happens next is under that service’s own policy.

5. Booking a session, your calendar, and the call

Booking a 1:1 call involves a little more than the rest of the site, so it is worth being exact about it.

• Taking a slot holds it and spends credits straight away. The request then waits to be confirmed by hand, and you are told either way.
• What you write in the agenda box is read before the call and stays attached to the booking.
• Once a session is confirmed, an entry is created in my own Google Calendar, provided calendar sync is switched on. If the invitation option is also on, your email address is added to that entry as a guest, which means Google receives it and the invitation arrives in your inbox.
• Confirmation email may carry a calendar attachment so that the call lands in whichever calendar you use, without involving Google at all.
• A reminder is sent by email before the call, unless reminders are switched off.
• Sessions are not recorded. If a recording would ever be useful, it would be agreed with you first, in the call.
• If a confirmed call is missed without a message, it is recorded as a no-show, and booking stays closed on your account until that is lifted.
• After a session you may be asked once whether you would leave a short review. Answering is optional, and a review is published only if you say it can be.

Sefism never reads your calendar. The Google connection belongs to my own account and is one-way: it writes the session into my diary and sends you an invitation. No access to your calendar is requested at any point, and none is held.

6. What is public, and what is not

Your Sefism profile is private unless you explicitly publish it. Publishing is opt-in, per section: you choose whether your about text, experience, education, projects, skills, internship availability and recommendations appear.

Sections you keep private are never sent to the browser. They are filtered out on the server, not merely hidden with CSS.

A published profile is public on the internet at /u/your-slug and may be indexed by search engines. Unpublishing removes it from the site, but search engines may keep a cached copy for a while; you can ask them to remove it. Do not publish anything you would not want a future employer to read.

Three other things can be public, and it is worth knowing which:

• Credentials. A certificate issued to you has a verification page at /verify so that an employer can check it. It shows your name, what the credential is for and its dates. Ask by email and it can be revoked or taken down.
• Contributions. Company and university entries you submit are published as site content. A job or internship listing you send in is published only after review, and only its details appear (organisation, role, location, pay and the link to apply). Your name, email address and note are never shown with any of them.
• The questions library. Public answers at /questions are written as anonymous composites of what people ask. Nothing identifying is published from a query you sent, and your query itself is never made public.

Everything else stays private: your queries and project threads, your bookings and what you wrote in them, your roadmap and course progress, your ratings, votes and reports, and anything you send through a form.

7. Analytics, cookies and local storage

Sefism uses the minimum necessary, but it is no longer none, so here is the whole of it.

There are no advertising cookies, no cross-site tracking pixels, and no profiling for marketing. If you would rather not be counted at all, any browser setting or extension that blocks Google Analytics works here; nothing on the site depends on it.

8. How long we keep it

• Account, profile and learning records: for as long as your account exists.
• Messages and replies: up to 3 years, so that a follow-up conversation still has its context.
• Bookings and session history: up to 3 years.
• Job and internship listings sent in: the sender’s name, email, role and note are kept with the listing while it exists and deleted with it; a listing that is declined is deleted.
• Credentials issued to you: kept for as long as they are meant to be verifiable, unless you ask for one to be revoked.
• Anti-abuse records (IP, user-agent): 12 months. Rate-limiting counters expire within minutes.
• Bulk email delivery records: 12 months.
• Error logs: up to 90 days.
• Analytics: retained by Google for up to 14 months, in aggregate reports.
• Library searches: 12 months, then deleted automatically.

9. Deleting your account and your data

You can delete your account yourself, at any time, from Account, then Security, then Delete account. No email, no waiting for a reply.

Deleting your account permanently and immediately removes:

• Your account record: name, email, photo, interests, notification preferences, dashboard state and bookmarks.
• Your entire profile, including any published public profile, which stops being reachable at once.
• Every message and query you sent, along with the replies attached to them, and any invitation you sent or received to a shared thread.
• Your bookings and session history, including what you wrote in them.
• Your learning records: roadmap progress, the roadmaps and cheat sheets you unlocked, course enrolments and quiz results, build track enrolments and submissions.
• Your credit requests, content requests, feature ideas, hearts, saved items, ratings, votes and reports.
• Any company or university entry you submitted that is still in the queue.
• Your early access application and any unused invitation code.
• All of your notifications.
• Your sign-in credentials, deleted from Firebase Authentication.

Two things survive, in a form that no longer identifies you. A credential issued to you keeps working at its verification page, because an employer may be relying on it, but it is detached from your account; ask by email and it will be revoked or removed. Company and university entries that were already published stay on the site as content, with nothing of yours attached.

Calendar entries for sessions that already happened may remain in my own diary, the same way any past meeting does.

Deletion is immediate and cannot be undone. Any unused credits are forfeited.

If you would rather I did it for you, or if something goes wrong, email support@sefism.com and I will handle it manually within 30 days.

10. Your rights

Wherever you live, you can ask me to: give you a copy of your data, correct anything wrong, delete your account, restrict or object to a particular use, or withdraw consent you previously gave. Most of these you can do yourself from the account area; for the rest, email support@sefism.com.

If you are in the EU, UK, or another region with a data protection authority, you have the right to complain to it. I would appreciate the chance to fix the problem first.

Your data is stored on infrastructure that may be located outside your country, including in the United States and the European Union. Where required, our providers rely on standard contractual clauses for those transfers.

11. Children

Sefism is intended for people aged 16 and over. It is not directed at children, and I do not knowingly collect data from anyone under 16. If you believe a child has created an account, email support@sefism.com and I will delete it.

12. Security

Access to the database and administrative tools is restricted and authenticated. Passwords are handled by Firebase and never reach our servers. The token that lets Sefism write a session into my calendar is stored encrypted at rest and is never sent to the browser.

No system is perfectly secure. If a breach affects your personal data, I will notify affected users and the relevant authority as required by law.

13. Changes to this policy

If this policy changes materially, the date at the top will be updated and, for changes that affect how your data is used, registered users will be notified by email or in-app notification before the change takes effect.