Privacy Policy

Kalyanamita (kalyanamita.com) is a bilingual library of Buddhist teaching, guided meditation and reflective writing. For any privacy question, or to exercise a right described below, contact hello@kalyanamita.com.

Account data: your name, email address, password (stored only as a salted PBKDF2 hash — never in plain text), preferred language, membership tier, and the date you joined.

If you sign in with Google we receive your name, email address and profile picture URL from Google; we never receive your Google password.

Content you create: comments, saved posts, practice sessions (duration and optional note), and your playback position in audio posts.

Mailing list: whether you have confirmed your subscription, plus a one-click unsubscribe token.

Payments: when you support us through PayPal we store the PayPal order or subscription identifier and the payer email address returned by PayPal. We never see or store card numbers.

Usage data: aggregate page views, the page path, the referring website's domain, and a per-day salted visitor hash. We do not store IP addresses, we set no tracking cookies, and the visitor hash changes every day so a browser cannot be followed across days.

Performance of a contract — creating and operating your account, delivering member-only content, and taking payment.

Legitimate interests — keeping the site secure, preventing abuse and spam, understanding which content is read, and improving the library.

Consent — sending you the newsletter, which you may withdraw at any time using the unsubscribe link in every email.

Cloudflare — hosting, the D1 database and R2 file storage.

Resend — delivery of newsletter, verification and account emails.

PayPal — payment processing; their own privacy policy governs the payment data they collect.

Google — only if you choose Google sign-in, for authentication.

Optional analytics: if a third-party analytics provider (for example Plausible or Cloudflare Web Analytics) is enabled, it receives aggregate pageview data under its own policy. When that is enabled you are asked for consent first.

Account and content data is kept until you delete your account, after which it is removed from our database.

Aggregate analytics counts contain no personal identifiers and are kept indefinitely so we can report long-term trends.

Email delivery logs at our processor are retained according to their own retention settings.

You may request access to your data, correct it, delete it, receive a portable copy, object to certain processing, or withdraw consent. You can export and delete your data yourself from your account page, or email us and we will action the request within 30 days.

If you are in the EEA or UK you also have the right to complain to your local supervisory authority.

The site is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.

Passwords are hashed, all traffic is served over HTTPS, and administrative access is limited by role. Our processors may store data outside your country, including in the United States, under their standard contractual safeguards.

If we make a material change to this policy we will update the date above and, for significant changes, notify registered members by email.