Short version: this site is static HTML/CSS/JS. By default it sets no cookies, runs no analytics, and sends nothing to third parties until you explicitly submit a form or open an external link.

Stored on your device only

• mg-theme — light/dark choice (localStorage).
• mg-lang — EN/HI choice (localStorage).
• mg-a11y-* — accessibility menu preferences: text size, motion, contrast (localStorage).
• mg-req-* — request bookkeeping on the owner's own browser only (admin console).

These stay in your browser; nothing is transmitted.

Data you choose to send

• Contact form — name, email/address and message are delivered to the owner's inbox via Web3Forms (api.web3forms.com) when configured; otherwise the form opens your own mail client. Used solely to reply.
• Private-contact requests — your name, reply-to, reason and requested items are written to a Supabase Postgres table the owner alone can read (row-level security blocks anonymous reads, edits and deletes). Nothing is shared with third parties.
• Approved reveal links — when the owner approves a request, a link containing an opaque token is issued; the token resolves against Supabase until its expiry or revocation. Token documents hold only what the owner chose to share.

Third-party services (all opt-in or owner-enabled)

• Supabase — Postgres database + authentication: request queue, reveal tokens, link/post registries, owner sign-in. Subject to Supabase's privacy policy and terms.
• Web3Forms — form-to-email relay for the contact form.
• GitHub Sponsors — payments are handled entirely on github.com under GitHub's terms; this site only links there.
• UPI — the QR/deep link are generated locally in your browser and open your own UPI app; this site is not a party to the transaction.
• Cloudflare Web Analytics — cookieless aggregate analytics; loads only if enabled by the owner.

Server-side

Hosting (Vercel) sees standard request logs (IP, user-agent, path) — unavoidable for any website; this site performs no application-level logging of visitors.

Your controls

Clear site data via your browser to remove the localStorage preferences above. To have a submitted request or message deleted, email manager@mridungupta.eu.org.