Privacy Policy

Who is responsible for your data

The EWU Express (“we”, “us”) is the student news publication of East West University, Dhaka, Bangladesh. We are the data controller for the small amount of information described on this page — meaning we decide why it is held and what happens to it.

Our contact address for anything on this page is printed at the bottom of every email we send, and shown at the end of this policy.

What we collect, and what we don't

If you subscribe to the newsletter

• Your email address — the only thing you type in.
• When you subscribed and when you confirmed, so we can show that you asked for the emails.
• Whether you have unsubscribed, so we never mail you again by accident.
• Two random codes tied to your subscription: one for the confirmation link, one for the one-click unsubscribe link. They identify the subscription, not you, and they are replaced when you resubscribe.

We never collect your name, phone number, student ID, address, photo, or anything about your studies. There are no reader accounts on this site.

Reading counts

Each story shows how many times it has been read. That counter is a number attached to the story, not to you. To stop the same reader being counted repeatedly, your IP address is checked in the server's memory for up to one minute and then discarded — it is never written to our database and never linked to a subscription.

Signing in (staff only)

Editorial staff sign in to publish stories. That sets a single session cookie, and the account holds a name, an email address and a password that is stored only as a one-way hash — we cannot read it.

Your display preference

If you switch between light and dark, that choice is saved in your own browser (local storage). It is never sent to us.

What we do not do

• No advertising, ad networks, or sponsored tracking pixels.
• No third-party analytics — no Google Analytics, no session recording, no heatmaps.
• No social media trackers or embedded follow buttons.
• No profiling, and no automated decisions about you.
• We do not sell, rent, or trade your address with anyone, ever.

Why we are allowed to hold it

For newsletter emails, our basis is your consent. You give it by submitting the form and then clicking the confirmation link we email you — we only add an address to the mailing list after that click, which is why the first email you receive is a confirmation request rather than a story. You can withdraw consent at any time.

For reading counts and keeping the site secure (blocking spam signups and brute-force attempts), our basis is our legitimate interest in running a working publication. This processing involves no stored personal data beyond what is described above.

Who else is involved

We use a small number of service providers to run the site. They process data only on our instructions:

• Vercel — hosts the website. Like any web host, its servers record standard request logs, which can include IP addresses.
• A managed database service — stores the subscriber list, story content and the delivery log.
• Google (Gmail) — sends our emails from the publication's own mailbox. Google necessarily handles the recipient address in order to deliver the message.

That is the whole list. We do not share your address with advertisers, sponsors, university offices, or other student groups, and we do not transfer it for anyone else's marketing.

How long we keep it

• While you are subscribed: your address, so we can send you stories.
• After you unsubscribe: we keep the address in a suppressed state. This is deliberate and is the only way to guarantee you are not re-added or mailed again; a bare deletion would allow the same address to be subscribed afresh with no memory of your opt-out.
• Until you ask us to delete it: you can request full erasure instead of suppression (see below), and we will remove the address and its delivery records.
• Delivery records (which story was emailed to which address, and whether it succeeded) are kept as an operational log so that a send can be retried safely and never duplicated.
• Pending signups that never confirm are never mailed and can be deleted on request.

Your choices and your rights

• Unsubscribe — every email carries a one-click unsubscribe link in the footer, and mailbox providers can use the standard unsubscribe button shown at the top of the message. Either one takes effect immediately.
• Delete — ask us and we will erase your address and its delivery history from the mailing list.
• Access or copy — ask us what we hold about your address and we will provide it.
• Correct — if your address was recorded wrongly, tell us and we will fix it.
• Object — you can object to any processing described here; if you are subscribed, unsubscribing settles the question immediately.
• Complain — if you are in the EU or UK you may complain to your national data protection authority. Wherever you are, please tell us first so we can fix it.

We answer these requests as quickly as we can and, at the latest, within 30 days.

Cookies and local storage

This site sets only one cookie: a session cookie created when an editor signs in to the publishing panel. It is strictly necessary for that sign-in, and readers never receive it. Your light/dark preference lives in your browser's local storage and is not a cookie.

Because we use no advertising, analytics or tracking cookies, visitors are not asked to consent to any. If that ever changes, we will ask you first.

Emails we send

There are exactly two kinds: the one-time confirmation message when you sign up, and a story email when we publish. We do not send marketing, sponsored mail, or anything on behalf of third parties, and we do not rent the list out.

Security

Traffic is encrypted in transit. The mailing list and editorial panel are reachable only by authenticated staff, passwords are stored as hashes, and sign-up and sign-in attempts are rate-limited to block abuse. If we ever became aware of a breach affecting your address, we would tell you.

Students, and readers under 18

Our audience is university students and staff. We do not knowingly collect information from anyone under 18, and we do not target the newsletter at minors. If you believe a child has subscribed, contact us and we will remove the address.

Changes to this policy

If we change how we handle your data, we will update this page and move the date at the top. If the change is significant — for example, if we ever introduced analytics or advertising — we would tell subscribers by email before it took effect.

Questions

Read the terms of use for how the publication and its content may be used, or contact us using the details at the end of this page.