Privacy Policy

1. Introduction & Scope

Welcome to Patwary Software. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you access or use any of our software products, web applications, and services hosted under the domain zahidp.com and its subdomains (including, without limitation, sq.zahidp.com, orbit.zahidp.com, tsp.zahidp.com, and production deployments such as zahid-finance.vercel.app).

By using any application or service provided by Patwary Software, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with any term of this policy, please do not access or use our applications.

2. Who We Are & Contact Information

Patwary Software is an independent software development brand founded and maintained by Md Zahid Hasan Patwary, a solo full-stack developer based in Dhaka, Bangladesh.

• Operator & Data Controller: Md Zahid Hasan Patwary
• Brand Name: Patwary Software
• Primary Contact Email: mdzahidhasanpatwary@gmail.com
• Location: Dhaka, Bangladesh
• Official Website: https://zahidp.com/software

3. Information We Collect

We minimize data collection to only what is strictly necessary to authenticate your account, maintain security, and deliver application functionality.

3.1 Data Collected via Google Sign-In (OAuth 2.0)

When you choose to sign in to any Patwary Software web application using “Sign in with Google”, Google prompts you to share basic profile information. We only request basic identification scopes (openid, email, and profile):

• Full Name: Used to personalize your account profile and display your name inside the application.
• Email Address: Used as your unique account username and identifier for essential security notifications.
• Profile Picture URL: Used optionally as an avatar inside the app interface.
• Google User Identifier (Sub ID): A unique cryptographic string generated by Google to match your account upon subsequent logins.

We do not access or request sensitive Google scopes. We never request access to your Google Drive, Gmail, Google Contacts, Google Calendar, or Google Photos.

3.2 Data You Directly Provide in the Applications

Depending on which specific application you utilize, you may provide content directly:

• Financial Records & Ledgers (e.g., Zahid Finance): Personal transactions, lending balances, debt records, trust money entries, categories, and personal net-worth figures you choose to enter.
• Academic Queries (e.g., Scholar Quest): Scholarship searches, saved opportunity bookmarks, and academic filters.
• Operational Data (e.g., Dhakaiya Bites POS / Orbit): Menu items, order tickets, inventory quantities, and task notes.
• Support Communications: Inquiries, bug reports, and feedback submitted via email or contact forms.

3.3 Technical & Device Information

When accessing our web services, Vercel edge servers automatically record standard, non-identifying technical log data, including IP address (anonymized/truncated for geolocation), browser type, operating system, and request timestamps to prevent malicious abuse and ensure server availability.

4. How We Use Your Information

We use the collected information solely for the following legitimate purposes:

• Authentication & Account Creation: Verifying your identity via Google OAuth and maintaining your user session.
• Application Functionality: Storing and presenting your user data (ledgers, bookmarks, notes, or operational records) within the app you are using.
• Security & Abuse Prevention: Detecting fraudulent account creation, mitigating DDoS attacks, and ensuring platform integrity.
• Direct Communication: Replying to direct technical support inquiries or critical data-privacy notices initiated by you.

Zero Commercial Monetization: We do not sell your personal data, we do not rent it, and we do not use your information to build advertising profiles or display targeted advertisements.

6. Data Storage & Infrastructure Processors

To provide high availability, data security, and encryption, Patwary Software utilizes industry-standard, trusted cloud infrastructure:

• Supabase Inc. (Database & Auth Engine): User account data, hashed session identifiers, and user application records are stored within managed PostgreSQL databases hosted by Supabase. Data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. We utilize PostgreSQL Row-Level Security (RLS) policies so that each user can only read and write their own data.
• Vercel Inc. (Web Hosting & Edge Delivery):Our web applications and static assets are deployed across Vercel’s global content delivery network with automated HTTPS encryption and automated DDoS mitigation.

7. Cookies & Local Storage

Our web applications strictly use cookies and HTML5 local storage for essential functional and authentication purposes:

• Session & Auth Tokens: Secure HTTP-only cookies and local storage keys issued by Supabase Auth to keep you securely signed in during your session.
• UI Preferences: Local storage flags to remember your dark/light mode preference and interface language choice.

We do not use advertising cookies, third-party analytics trackers, or cross-site tracking pixels.

8. Data Sharing & Zero-Sale Commitment

We do not sell, rent, trade, or monetize your personal information.

We only share personal information under the following limited circumstances:

• Authorized Sub-processors: With Supabase and Vercel solely for database hosting, cloud compute, and authentication infrastructure as described in Section 6.
• Legal Compliance: If required by a valid court order, subpoena, or applicable legal obligation under the laws of Bangladesh or other relevant jurisdictions.
• Protection of Rights: To enforce our Terms of Service or protect the security, integrity, and safety of our users and services.

9. Data Retention & How to Request Deletion

We retain your account and application data only for as long as your account remains active and as needed to provide application functionality.

10. Your Privacy Rights & Choices

Depending on your jurisdiction, you have several rights regarding your data:

• Right of Access: You can request a summary or export of the personal data we hold about you.
• Right to Rectification: You may update or correct inaccurate profile details at any time directly through the apps or by contacting us.
• Right to Erasure (“Right to be Forgotten”): You may request complete erasure of your account and records as outlined in Section 9.
• Revocation of Google OAuth Access: You can revoke Patwary Software’s access to your Google account at any time through your Google Account Permissions Page.

11. Children’s Privacy

Patwary Software web applications are designed and intended for general adult audiences, students, and professional operators. Our services are not directed to children under the age of 13 (or under 16 in relevant jurisdictions). We do not knowingly collect or solicit personal information from children under 13.

If we learn that we have inadvertently collected personal data from a child under 13 without verifiable parental consent, we will promptly delete that data. If you believe a child has provided us with personal information, please contact us immediately at mdzahidhasanpatwary@gmail.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations, application features, or data processing practices. When updates occur, we will revise the “Effective & Last Updated” date at the top of this page.

For significant changes, we will provide noticeable notice on our application home page or directly inside user dashboards. Continued use of our applications after any update constitutes your acceptance of the revised policy.