Privacy Notice

Scope

This notice applies to the public website, OST Visualizer license and activation services, license administration, and Bid Tracker operated through fabianhad.com. The public portfolio has no submission form; its contact links open your own email or messaging application.

Information we handle

• License and account records: license key, license holder name, optional company and email, license status and expiration, activation limit, administrative notes, and administrator username and password hash.
• Activation and validation records: a hashed hardware identifier (HWID), activation and deactivation times, validation result and error code, and IP address. Successful activations also store the Windows account name, computer name, and domain, workgroup, or unjoined status and name reported by the desktop application. These reported names are audit context; they are not used as authenticated Windows claims.
• Bid Tracker records: client, company, project, bid and follow-up dates, status, work type, scope, notes, contact email and phone, expected schedule, follow-up history, and account preferences. Bid Tracker is organized by license.
• Service and security logs: IP address, request date and time, request method and path, response status, referrer, browser or client user-agent, application errors, and administrator login events. In-memory rate limiting also uses IP addresses.

How we use information

We use this information to issue and administer licenses, activate and validate authorized devices, enforce activation limits, authenticate restricted services, provide and save Bid Tracker features, respond to requests, maintain and secure the services, prevent abuse, diagnose failures, and keep operational audit records.

OST Visualizer project files are opened from locations selected by the user, such as the user's device or a configured SQL Server. The fabianhad.com license API does not receive those project files. The desktop application stores its license cache, application settings, and workspace preferences on the user's device.

Cookies and browser storage

Authenticated services use a host-only Flask session cookie. It is marked Secure, HttpOnly, and SameSite=Lax in production. Bid Tracker sessions normally end when the browser session ends. Administrator sessions do the same unless “Remember me” is selected, in which case the configured lifetime is up to 30 days. The cookie contains signed session data used to identify the authenticated license or administrator; it is not an advertising cookie.

Local browser storage holds the selected light or dark theme. Bid Tracker also stores a license-scoped browser preference record for display density, visible sections, notification and install-prompt choices, and which follow-ups have already generated a browser notification. Bid and account-preference data itself is stored on the server. The site does not use session storage.

Third-party services

Pages load fonts from Google Fonts and JavaScript modules from the unpkg content delivery network. Those browser requests disclose ordinary network information, such as IP address and user-agent, to those providers. The server requests public repository and release information from GitHub and caches it briefly; those server-side requests do not send a visitor's IP address to GitHub. If you follow a GitHub, Telegram, Microsoft, or download link, your browser contacts that service directly and its own privacy terms apply.

No analytics service, advertising network, behavioral advertising, tracking pixel, CAPTCHA, payment processor, or transactional email provider is integrated into this application. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Tracking choices

Because the site does not perform cross-site behavioral tracking or sell or share personal information for targeted advertising, browser Do Not Track and Global Privacy Control signals do not change how the site operates. Third-party font and content-delivery providers receive the limited request information described above.

Retention and deletion

Bid Tracker users can delete individual bids and reset account preferences. Administrators can deactivate devices and delete license records; deleting a license also removes its associated activation, validation, Bid Tracker, and preference records. Expiration or deactivation alone does not delete those records. There is no automatic fixed deletion schedule for license, activation, validation, or Bid Tracker records.

Web server access and error logs are configured for daily rotation with 14 retained rotations. Application container logs rotate by size, with up to three 10 MB files. Browser storage remains until it is cleared in the browser. We may retain information when reasonably needed for service operation, security, recordkeeping, dispute resolution, or legal obligations.

Security

We use safeguards appropriate to this service, including HTTPS, restricted administrative access, password hashing, signed and protected session cookies, request limits, and signed license responses. No method of transmission or storage is completely secure, so absolute security cannot be guaranteed.

Your information and contact

You may ask about, correct, or request deletion of information associated with you by emailing fabian@fabianhad.com. Include enough information to identify the relevant license or service account. We may need to verify the request and may retain information where needed for security, legal, or operational reasons.

Material changes to this notice will be posted on this page with a revised effective date.