Privacy policy

Reading the site

You can read everything published on ChitraBarta without an account. We do not use analytics, advertising or tracking cookies, and we do not follow you across other websites.

Like every website, our server and our hosting provider record technical details of each request, such as the IP address, the type of browser and the page asked for. We use them only to keep the site working and secure, for example to stop abuse, and keep them for a short time.

Accounts

Galleries, curators and writers can create an account to publish. For an account we keep:

• your name and email address;
• your password, if you set one, stored only in a scrambled form (a hash) that cannot be turned back into the password;
• whether you have verified your email address, and your role on the site;
• what you publish: posts, pictures and files, with your name as their author.

If you sign in with Google or Facebook, they tell us your name, your email address and the number of your account with them, and nothing else. We do not post anything to them and do not see your contacts.

Your name appears publicly as the author of what you publish. Your email address does not.

Free tickets to exhibitions

When you register for an exhibition, we keep your name, phone number, email address, the number of seats, your ticket code and, at the door, when your ticket was checked and by whom. If you ask to recover a lost ticket, we email you a one-time code; it is stored in scrambled form and expires after ten minutes.

We use these details to give you your ticket, to let you recover it, and to let the organiser of the exhibition know who is coming. Each phone number can hold one registration per exhibition.

Emails

We send only the emails the site needs: to verify your email address (the link works for 24 hours), to reset your password (the link works for one hour) and to recover a ticket. We do not send newsletters or advertising, and we do not give your address to anyone else.

Cookies

ChitraBarta sets a single cookie, and only when you sign in (or start to, with Google or Facebook). It keeps you signed in until seven days after your last visit, cannot be read by scripts on the page and is used for nothing else. If you never sign in, no cookie is set.

Who can see your information

• The organiser of an exhibition (the account that published it) and the administrators of the site can see its registrations: names, phone numbers, email addresses, seats and check-ins. Gate staff chosen by the organiser see the details of a ticket when they check it at the door.
• Everyone can see what is published, with the name of its author.
• Companies that run parts of the site for us, only for that purpose: MongoDB Atlas (our database, on servers in India), Cloudinary (pictures and files), Google (delivery of our emails), Namecheap (hosting, in the United States) and Vercel (a test copy of the site, in the United States).
• Google or Facebook, if you sign in with them: they know that you signed in to ChitraBarta.
• Authorities, when the law requires it.

We do not sell personal information, and we do not share it for advertising.

Where your information is kept

Our providers keep information on servers outside Bangladesh, in India and the United States. We use providers that protect what they hold with access controls and encrypted connections.

How long we keep it

• Accounts: until you ask us to delete yours. Tell us whether what you published should be removed as well.
• Registrations: with the exhibition they belong to, so that the organiser has a record. Ask us and we will delete yours sooner.
• Sign-in: until seven days after your last visit. Email links and recovery codes expire as described above.
• Daily backups of the database: two days.

Your rights

You can ask us to show you the information we hold about you, to correct it or to delete it. Write to chitrabarta9@gmail.com from the email address it concerns, and we will answer within 30 days.

If you signed in with Facebook, you can also remove ChitraBarta from your Facebook account, under Settings, Apps and websites. That stops Facebook from signing you in here; to have your ChitraBarta account deleted as well, write to us.

Security

The whole site is served over an encrypted connection (HTTPS). Passwords and recovery codes are stored only in scrambled form, and registrations can be seen only by the people listed above. No system is perfectly secure: if you think your account has been misused, tell us straight away.

Children

ChitraBarta is not meant for children under 13 to use on their own. If you believe a child has given us personal information, write to us and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change matters for how we use your information, we will say so on the site.

Contact

ChitraBarta, chitrabarta.com: chitrabarta9@gmail.com