Privacy Policy

This page describes what data Quantcents Blog collects, why we collect it, and how we handle it. We try to keep this short and honest. As a Data Fiduciary under India's Digital Personal Data Protection Act 2023, the notice below also covers our DPDP-mandated disclosures.

Notice under DPDP Act 2023, s. 5

Identity of Data Fiduciary: Kunal Agarwal, operating Quantcents Blog at blog.quantcents.com.

Categories of personal data collected: email address (newsletter), Cognito user ID and Google profile (sign-in), comment text, IP address (rate-limit and abuse), device/browser metadata (analytics), session recordings — page content, clicks, scrolling, typed input, console logs, and network activity, unmasked (analytics; see “Analytics & session recording” below).

Purpose of processing: deliver the newsletter, enable comments, prevent abuse, measure which posts get read.

Your rights under DPDP: access, correction, erasure, grievance redressal, and the right to complain to the Data Protection Board of India.

Data retention: newsletter subscribers — until you unsubscribe; comments — 24 months from posting, or until you request deletion; PostHog analytics — 13 months; PostHog session recordings — 30 days; session cookies — 7 days.

Children: the blog is not intended for users under 18. We do not knowingly collect data from minors. If you are under 18, do not sign in or subscribe.

Grievance Officer

Per DPDP Act 2023 s. 13 and IT Act 2000 s. 79 + Intermediary Rules 2021/2023:

• Name: Kunal Agarwal
• Email: research@quantcents.com
• Acknowledgement: within 24 hours of receipt
• Resolution: within 7 days for DPDP grievances; within 15 days for content-takedown grievances; within 36 hours for court or government takedown orders

Cookie consent

We show a consent banner on your first visit. Before you choose, and if you decline, we count your visit without cookies: nothing is stored on or read from your device, and you are identified only by a rotating code our analytics provider derives on its own servers, which cannot be tied back to you or to your other visits. Session recording does not run, and Vercel Analytics does not load at all.

Analytics cookies, session recording, and any link between your visits and your account only begin if you click Accept. Essential cookies for sign-in (qc_session, qc_oauth_pending) and the consent record itself (qc_consent_v1) are always set — they are necessary for the site to function. The consent record is shared with quantcents.com, so you are not asked twice across the two sites. You can change your choice at any time using the Cookie settings link in the footer of any page — this immediately stops session recording and drops you back to cookieless counting until you choose again.

What we collect

Newsletter signups

When you subscribe to the newsletter, we store your email address and the source you signed up from (e.g., post-rail, footer). We use this only to send you the newsletter.

Sign-in & comments

Sign-in is via Google OAuth, mediated through AWS Cognito. When you sign in, we receive your email address and public Google profile (display name, profile picture). We store a session cookie containing those identity claims — signed but not encrypted, no third-party tokens. The session cookie is HTTP-only, same-site, secure in production, and expires in 7 days.

When you post a comment, we store your Cognito user ID (sub), display name, and the comment text. Comments are moderated by the blog operator and may be hidden if they violate community standards.

Analytics & session recording

We use PostHog for product analytics and session recording. Session recording captures a video-like replay of your visit — page content, clicks, scrolling, and typed input — and is not masked: pages are recorded as they actually render, because a masked screen is not useful for diagnosing a broken one. PostHog also captures browser console log messages and the request/response bodies of network calls your browser makes to our own API, for the same reason. Session recordings are retained for 30 days.

If you sign in, PostHog associates your activity with your Cognito user ID, and links it with your activity on quantcents.com — analytics identity is shared across the two sites via a single cookie scoped to .quantcents.com, so accepting or declining consent on one site applies to both, and (once you sign in on either) your reading activity here and your usage of the trading app there are associated with the same underlying profile. We do not sell or share your analytics data.

We also use Vercel Analytics, which captures basic anonymized performance and Web Vitals metrics.

UTM parameters in URLs (e.g. utm_source=linkedin) are captured to attribute traffic to the right campaign. We don't use third-party advertising trackers, retargeting pixels, or data-broker integrations.

Cookies we set

• qc_session — your sign-in session (7-day expiry, HTTP-only).
• qc_oauth_pending — short-lived (10-minute) state for the Cognito sign-in handshake.
• PostHog cookies — device/session identifiers used by PostHog analytics and session recording, shared with quantcents.com (scoped to .quantcents.com) so your identity is consistent across both sites.

What we don't collect

• Payment information (we don't take payments).
• Phone numbers, addresses, government IDs, or financial-statement data.
• Information from any third-party data broker.

How we share data

We don't sell or rent your data to anyone. We use these processors as part of running the blog:

• Vercel — hosts the site and runs serverless functions.
• AWS Cognito — handles sign-in flow and identity tokens.
• Google — when you sign in via Google OAuth.
• PostHog — analytics.
• An email service provider — when the daily brief launches, we will name the processor here before any email is sent. We do not currently send any emails.

Your rights

Email research@quantcents.com if you want to:

• Unsubscribe from the newsletter (every email also has an unsubscribe link).
• Delete your comments or your account.
• Request a copy of all data we hold about you.

We'll respond within 7 days.

Changes to this policy

We'll update the “Last updated” date at the top when this page changes. Material changes will be announced in the newsletter.