Privacy
Updated 3 Nov 2026
Privacy
Last updated 3 November 2026.
In plain words. This is one website run by one person. Reading it sets two small cookies that keep forms working and expire after two hours; there are no advertising cookies, no tracking pixels and no fonts or scripts loaded from other companies. Each visit also leaves your IP address and browser name in a short-lived record on the server. If you subscribe, join a waitlist or send a message, I keep your email address encrypted and only what you typed. You can ask me to delete it at any time. YouTube is contacted only when you press play on a video. Purchases happen at Lemon Squeezy, which handles your payment details; I never see them.
1. Who runs this site
assemfarag.com and vramble.app are run by one person, who is responsible for your data: Assem Mohamed Farag Ahmed Farag, an individual, Mithaq St 1, Zahraa Nasr City, Cairo, 11762, Egypt. Privacy contact: support@vramble.app. The same contact is shown on the contact page. vramble.app is part of the same site, and this policy covers it too.
2. When you simply visit
Cookies. The site sets two cookies, both needed for it to work, both first-party:
| Cookie | Purpose | Lifetime | Notes |
|---|---|---|---|
assem-farag-session |
Keeps a session so forms can show messages and protect themselves against forged submissions | 120 minutes after your last request | HttpOnly (scripts cannot read it), SameSite=Lax |
XSRF-TOKEN |
Anti-forgery token for forms | 120 minutes | Readable by the page's own scripts, as the framework requires |
No other cookies are set by the site. Because these cookies are strictly necessary, the site does not show a cookie banner.
Session record. Each visit opens a session that the server stores in its database: the session ID, your IP address, your browser's user-agent string, the time of your last request, and the session contents (for example a form's status message). Expired sessions are deleted automatically by the framework's clean-up, which runs on about 2 in every 100 requests, so a record usually disappears within hours of your last visit.
Server logs. The hosting company, Hostinger, keeps standard access logs (IP address, time, page, browser) for security and operations. How long it keeps them is set by Hostinger's privacy policy: https://www.hostinger.com/legal/privacy-policy (opens in a new tab).
No remote resources. Pages load fonts, styles and images from this site only. There are no web fonts from other companies, no advertising, no social-media buttons and no tracking pixels.
Analytics. The site runs no analytics.
- If you enable analytics: The site uses [tool name], a cookieless analytics service. It counts page views, referring sites, browser and country, without cookies and without storing your IP address. [Link to its privacy page and data location.] The admin field accepts any script, so this paragraph is only true if the pasted snippet is a cookieless tool.
3. Forms
Every form is checked against spam (a hidden field, a minimum time on the page, and a limit of 5 submissions per IP address per hour and 3 per email address per day). These checks keep counters in the server's cache for up to an hour or a day; they are not stored with your data.
Wherever an email address is stored, it is stored encrypted, with a separate keyed hash of it (HMAC-SHA256) used only to find your record. Where an IP address is kept as evidence, only a keyed hash of it is stored, never the address itself. A keyed hash cannot be reversed without the site's secret key, but it is still treated as personal data. Links in emails carry random tokens; the database keeps only hashes of them.
3.1 Newsletter (assemfarag.com)
| What is stored | Why |
|---|---|
| Your email address (encrypted) and its keyed hash | To send the emails you asked for and find your record |
| The topics you picked (Tools, Stories, Writing) | To send only those |
| Time of sign-up, a keyed hash of your IP address, and your browser's user-agent string (up to 255 characters) | Evidence of your consent |
| Time you confirmed, and time you unsubscribed if you do | Double opt-in and unsubscribe records |
Double opt-in. Nothing is sent to you except one confirmation email until you press the button in it. The confirmation link works for 7 days. Opening a link changes nothing; only pressing the button on the page does, so inbox scanners cannot sign you up or out.
Unsubscribe. The site does not send list emails yet. Until it does, reply to any email or write to support@vramble.app and I will remove you.
Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time.
3.2 Waitlist (Studio early access)
Your email address (encrypted) and its keyed hash; the graphics card and the use you describe, if you fill those in; time of sign-up; a keyed hash of your IP address; and the time you confirmed. Confirmation works the same way as the newsletter (7-day link, button press). You get one email when a seat opens. Legal basis: consent.
3.3 Contact and quote forms
Your name, your email address (encrypted) and its keyed hash, the subject and message you write, the budget band you pick (quote form), and a keyed hash of your IP address. The name, subject and message are stored as you typed them, not encrypted. A copy of the message, including your name and email, is emailed to my inbox at support@vramble.app so I can reply. Legal basis: my legitimate interest in answering you (Art. 6(1)(f)), or steps before a contract if you ask for a quote (Art. 6(1)(b)).
3.4 Email delivery
Confirmation emails and the contact-form copy are sent through Hostinger's own mail service. That provider handles your email address and the message to deliver it.
4. Videos
Story pages show a poster image from this site. Nothing is loaded from YouTube until you press play. When you do, the video plays in YouTube's privacy-enhanced player (youtube-nocookie.com). From that moment YouTube (Google) receives your IP address and browser details and may set its own storage, under Google's privacy policy: https://policies.google.com/privacy (opens in a new tab). "Watch on YouTube" and "Watch on TikTok" are plain links that take you to those sites.
5. Buying
The vRamble app is free and needs no payment. What is sold here, today vRamble Studio and packs, is handled by Lemon Squeezy, the merchant of record: Lemon Squeezy sells you the licence, takes the payment, charges tax and sends the receipt and licence key. The buy button takes you to Lemon Squeezy's checkout. This site never sees your card or payment details. Lemon Squeezy shares with me what a seller needs: your name, email address, country, what you bought, and your licence key and its activations. Lemon Squeezy's privacy policy: https://www.lemonsqueezy.com/privacy (opens in a new tab). Its buyer terms: https://www.lemonsqueezy.com/buyer-terms (opens in a new tab).
6. Free downloads
Downloading the free vRamble app, or Studio's trial, is a normal file download from this site. Nothing is stored about it beyond the server logs in section 2. The free app sends nothing by itself. Studio makes one automatic connection, a licence check to Lemon Squeezy when you activate a key and every 30 days after. Both are described in the vRamble app privacy notice, shipped with the app; this site takes no part in them.
7. How long data is kept
I keep data for these periods and delete it after them.
| Data | Kept for |
|---|---|
| Session records | Until about 2 hours after your last request (automatic) |
| Unconfirmed newsletter or waitlist sign-ups | 30 days after sign-up |
| Confirmed newsletter subscribers | Until you unsubscribe |
| After you unsubscribe | Email deleted within 30 days; only the keyed hash and dates kept as proof of the opt-out, for 3 years |
| Waitlist entries | Until the product's early access is over, or 12 months, whichever comes first |
| Contact and quote messages | 24 months after the last message, unless they lead to a contract |
| Copies in my mailbox | Same as above |
| Hosting logs | As set by Hostinger's privacy policy (section 2) |
8. Who else receives data
Only these, and only for the purposes above: the hosting company (Hostinger), which also delivers the site's email; Lemon Squeezy (if you buy); and YouTube (if you press play). I do not sell personal data and do not share it for advertising.
Some of them are outside your country, and the site is run from Egypt. The servers are in the Hostinger data-centre region chosen for the hosting plan. For visitors in the EU or UK, transfers rely on the providers' standard contractual clauses or similar safeguards.
9. Your rights
You can ask to see the data I hold about you, correct it, delete it, receive a copy of it, object to its use, or withdraw consent. Write to support@vramble.app. I answer within one month. Because emails are stored encrypted with a lookup hash, I can find your record from your email address alone. If you are in the EU, the UK or another place with a data-protection authority, you can also complain to that authority.
10. Children
This site is not aimed at children. Do not use the forms if you are under 16.
11. Changes
When this policy changes, the date at the top changes. If a change affects how your email address is used, I will tell subscribers before it applies.
Privacy contact: support@vramble.app.