Privacy and storage on your device

Your local tools

Preferences, checklist states and notes, shortlist entries, email inputs and draft text are not submitted by our tools to the application server or added to URLs, server sessions or the database. The tools use sahla-scholarships:v1:preferences, sahla-scholarships:v1:checklist, sahla-scholarships:v1:shortlist and sahla-scholarships:v1:email-draft. Email-draft persistence is opt-in; otherwise it stays in memory and is lost on navigation or reload.

Storage and deletion limits

Local storage is unencrypted and accessible to same-origin scripts and people using the device. Do not enter passwords, passport numbers, health information or sensitive documents. The browser can block or erase storage; there is no server backup or cross-device synchronization. Storage failures fall back to memory with an explanation.

Use the confirmed per-tool or product-wide deletion controls in the checklist and email tools. Product deletion touches only Sahla Scholarships keys; it does not erase Sahla CV or unrelated product data. Failed deletion is reported. Another open page may retain text in memory while draft persistence is disabled after a change notification; reload or clear it there to discard that text too. Deleting storage does not retract anything you copied or sent yourself.

Network requests and links

Page visits, assets and public directory filters reach the server, which handles connection information such as your network address. The site uses HTTPS on a Contabo virtual server. Cloudflare manages DNS; this hostname currently connects directly to the server without the Cloudflare proxy.

The dedicated access log records time, request method, URI path, response status and response size, without including the network address, query values, cookies or request body. Error logs may contain request details. Keep private information out of web addresses and public search filters.

Dedicated access and error logs are configured for daily rotation, up to 14 archived copies and a 14-day age rule evaluated during rotation. Daily application logs are configured for 14 days. Actual deletion depends on rotation running; this is not a promise that every trace across all services disappears after 14 days, and it does not specify retention for system, hosting-provider or certificate-service logs. Server permissions protect the log files; they are not available through public site pages.

Public and admin pages may set essential session and CSRF cookies for request security and administrator sign-in. These cookies do not contain your local tool entries. Tool-data deletion does not clear cookies. There are no public student accounts.

The current implementation includes no third-party analytics or advertising scripts. Following an official or Sahla CV link contacts another server under its own policies. The CV link does not transfer your local tool data. This platform has no document upload, email sending or application submission capability.

Privacy contact

There is currently no public email address or form for privacy reports. The contact page states this limitation; the platform does not receive correction notes or student documents through a form. Review an external service’s privacy information before contacting it or entering your data there. This page will be reviewed when hosting or logging changes, or an approved contact destination is added.