গোপনীয়তা নীতি

Last updated: 1 November 2026. This page explains how Sotto Kotha (sottokotha.com) handles information when you read or contact us. We wrote it to match what the site actually does — not a generic template pasted from somewhere else.

Sotto Kotha is a Bangla-first information portal covering education and results, jobs, sports, news and everyday guides. At launch there are no reader accounts, newsletters or public comments. We are not building marketing lists from visitor profiles.

1. Who this policy covers

It applies if you browse sottokotha.com, search, share an article, switch language or theme, or email us. Staff who log into WordPress have additional session cookies; ordinary readers do not.

Audience	Typical activity	Covered here?
Readers in Bangladesh	Read, browse topics, search	Yes
Diaspora / English UI users	Language switch, same articles	Yes
Email senders	Corrections, questions, rights notices	Yes
Editors / admins	WordPress login	Briefly; internal rules also apply

2. Who we are and how to reach us

Item	Detail
Service / brand	সত্য কথা / Sotto Kotha
Website	https://sottokotha.com
Privacy & general contact	[email protected]
Related pages	Contact · About · Terms

A postal address or company registration block is not listed here yet. When available, it will appear on this page. Until then, email is the primary channel.

3. Snapshot — what we keep, what we do not

Topic	Status (November 2026)
Reader accounts / sign-up	None
Comments	Disabled site-wide
Contact form plugins	None — email only
Newsletter / e-commerce / memberships	Out of scope for v1
Language & theme preference	Cookie / local storage on your device
Saved-article list	Browser localStorage only
Google Analytics (GA4)	Wired in options, Measurement ID empty — loads only after consent when enabled
Ads (e.g. AdSense)	Slots reserved; ads toggle currently off
Consent banner	Designed to appear when analytics or ads are enabled
CDN / security edge	Cloudflare DNS, cache, WAF

4. What kinds of information we may process

“Personal information” means data that identifies you alone or together with other data. The categories below follow our real stack.

4.1 Information created automatically

Data	Examples	Why	Where it may sit
Server / proxy logs	IP address, timestamp, requested URL, HTTP status, User-Agent	Security, abuse detection, debugging, cache health	Origin server and Cloudflare
Device & browser signals	Theme preference, language preference	Stable UI without flashes	Your device (cookie / storage)
Performance signals	Cache behaviour, server metrics	Core Web Vitals and reliability	Server / CDN tooling

4.2 Information you choose to send

Data	When	What we do
Email address and message body	You write to [email protected]	Answer questions, handle corrections, rights or DMCA notices
Page URL / description of an error / sources	Correction requests	Editorial verification and updates

Please do not email unnecessary sensitive data (passport numbers, full bank details, medical records). For corrections, a page link and a reliable source are usually enough.

4.3 What we do not intentionally collect

Reader profiles, dates of birth or national ID numbers
Payment cards or mobile-banking PINs (no on-site payments)
Microphone, camera or precise location permissions
Social login accounts
Public comment threads or user-generated content feeds

5. Cookies, local storage and similar technologies

Cookies are small text files a browser can store for a site. We use some first-party cookies/storage so the reading experience stays consistent. If analytics or ads are turned on, additional cookies may appear — and a consent notice is meant to show first.

5.1 First-party (Sotto Kotha)

Name / key	Type	Purpose	Typical lifetime
`sk_lang`	Cookie	Remember Bangla / English interface	About 1 year
`sk-theme`	localStorage	Remember dark or light mode	Until you clear it
`sk_lang` (storage)	localStorage	Client-side backup of language preference	Until you clear it
`sk_lang_pref`	sessionStorage	Short-lived hint while switching language	Until the tab closes
`sk_saved_posts`	localStorage	URLs you “save” — stays on your device only	Until you clear it
`sk_focus_mode`	sessionStorage	Keep reading/focus mode for the session	Until the tab closes

These first-party items are not sold to third parties for ad profiling. They exist so the site can remember your preferences.

5.2 WordPress (logged-in editors only)

Readers do not receive these. Editors who sign in get WordPress session cookies (wordpress_logged_in_*, wp-settings-*, and similar). See the WordPress.org Privacy Policy.

5.3 Third parties (when enabled)

Service	When active	Typical purpose	Read more
Google Analytics 4	Measurement ID set + consent where required	Aggregated traffic, popular pages, device class — product improvement	Google Privacy Policy · GA data practices
Google AdSense / ad network	Ads enabled + client ID	Show contextual or personalised ads in reserved slots	How Google uses cookies for ads · AdSense program policies
Cloudflare	While the site is live (DNS/CDN/WAF)	Faster delivery, DDoS/WAF protection, caching	Cloudflare Privacy Policy
Google Search Console / Bing Webmaster	After owner verification	Search performance tooling; usually no reader-side tracking cookies	Google · Microsoft Privacy

5.4 How you can control cookies

Clear or block cookies in your browser (Chrome: Settings → Privacy and security). Guide: Chrome cookie controls.
When analytics/ads are on, use our consent banner to refuse non-essential cookies or change your mind later.
Manage Google ad interest settings: Google Ad Settings and industry tools such as YourAdChoices.
Blocking language/theme cookies still lets you read; preferences may reset more often.

6. Why we use information

Purpose	Examples	Typical basis (plain language)
Run the site	Serve pages, remember language/theme, cache	Necessary to provide the service / legitimate interest
Security	Review attack or abuse signals in logs	Legitimate interest and security duties
Editorial improvement	Which guides are read most (if GA4 is on)	Consent where required, otherwise legitimate interest
Respond to you	Reply to your email	Responding to your request
Legal compliance	Respond to lawful notices	Legal obligation
Advertising (future)	Fill reserved ad slots	Consent where law or platform policy requires it

We do not sell readers’ personal information to data brokers. Bangladesh does not currently mirror the full EU GDPR statute; we still aim for clear disclosures and controls, especially for diaspora readers. Background reading: GDPR.eu overview and the ICO’s UK GDPR resources (comparative education, not legal advice).

7. Analytics

We plan to use Google Search Console and, when configured, Google Analytics 4 (GA4). Search Console is an owner tool and does not place a separate tracking cookie on your phone. GA4, when enabled, typically provides aggregated page views, referrers and device categories.

The GA4 Measurement ID is currently empty — production should not load GA4 yet.
When enabled, scripts are meant to load deferred and after consent where our settings require it.
Google’s explanation: Safeguarding your data in Google Analytics.
For EEA readers, Google’s processor terms may apply: Google Ads Data Processing Terms.

8. Advertising

The theme reserves CLS-safe slots in the header, home rail, in-article and footer areas. Ads are currently disabled in site options. If enabled, we may use Google AdSense or a similar network (ca-pub-… client ID).

A consent notice is intended when ads go live.
Editorial rules already ban betting, adult and scam promotions; we will try to keep ad inventory aligned with that standard.
Publisher rules: AdSense Program Policies; cookie explanation: Advertising cookies.
Personalised-ads controls: My Ad Center.

9. Share buttons and other websites

We avoid heavy third-party social widgets. Sharing usually uses the Web Share API, copy-link, or X/Facebook share-intent URLs. If you share, that platform’s own policy applies:

Articles may link to official portals or newsrooms. Their privacy practices are outside our control — check their policies before interacting deeply.

10. Hosting, CDN and security layers

The site runs over HTTPS. Traffic typically passes through Cloudflare (DNS, CDN, WAF), then the origin Nginx cache, PHP and database. Logged-out HTML may be cached; English cookie responses are kept out of shared caches where we can.

Layer	Role	Privacy note
Cloudflare	Proxy, cache, attack mitigation	May process request metadata; see cloudflare.com/privacypolicy
Origin VPS / web server	WordPress render, assets	Access and application logs kept for limited periods
Redis object cache	Performance	Page objects — not reader passwords
Backups	Disaster recovery	Limited access; planned daily DB / weekly files retention

Security measures include TLS, HSTS, security headers, constrained XML-RPC, disabled file editor and planned admin 2FA. No online service is risk-free; if something looks wrong, email [email protected].

11. Who we may share information with

Recipient	Why	Typical data
Infrastructure providers (host, Cloudflare)	Run and protect the site	IP, URL, technical logs
Analytics / ads (if enabled)	Measurement and advertising	Cookie IDs, page views — under their policies
Law enforcement / courts	When legally required	Relevant portions of records
Professional advisers (if needed)	Legal or security advice	Minimum necessary

We do not sell reader lists to brokers. If ownership of the site transfers, information may move with the service; we will try to give reasonable notice of material changes.

12. International transfers

Even if you read from Bangladesh, providers such as Cloudflare or Google may process data in other countries. Transfers rely on those providers’ contracts and safeguards. Their privacy pages describe the details. EEA readers may see references to Standard Contractual Clauses in Google/Cloudflare documentation.

13. How long we keep information

Data	Retention approach
Server / CDN logs	Limited operational window — often weeks to a few months, depending on provider settings
Email correspondence	As needed to resolve the matter and keep lawful records; unnecessary attachments deleted when practical
localStorage / sessionStorage	On your device — we cannot remote-wipe it; clear via browser settings
Editorial content backups	Per backup policy (planned daily DB, weekly files)
Analytics aggregates	Per Google account settings (when enabled)

14. Children and teens

The site publishes general information and education/jobs guides. We do not knowingly collect personal information from children under 13, and we do not offer reader accounts. If a parent believes a child emailed personal details, write to [email protected] — we will review and delete where appropriate. Comparative reference: FTC COPPA FAQ.

15. Your rights and choices

Rights vary by country. Where applicable, we consider requests for:

Right / choice	What you can do
Access	Ask what we hold about you in email threads and similar records
Correction	Ask us to fix contact details or factual site errors — see also our corrections policy
Deletion	Ask us to delete email records (legal retention may limit this)
Withdraw consent	Turn off analytics/ads cookies via banner or browser settings
Objection / restriction	Object to specific processing
Complaint	Contact a local consumer or data-protection authority where one exists

Email [email protected] with the subject “Privacy request”. We may ask a short verification question. We aim to reply within a few working days.

16. “Do Not Track” and similar signals

Browsers may send DNT or Global Privacy Control signals. Industry handling is still uneven. We may still use essential first-party storage to run the site. For non-essential analytics/ads, the consent banner and browser controls are the primary levers. Learn about GPC at globalprivacycontrol.org.

17. Automated decisions and profiling

We do not run automated decisions that produce legal or similarly significant effects on readers (for example credit scoring). If an ad network is enabled, it may use its own interest-based profiling — governed by that network’s policy and your opt-outs.

18. Changes to this policy

If the stack changes (for example GA4 or ads go live), we will update this page and the “Last updated” date. For significant changes we may also show a short site notice. Please revisit this page from time to time.

19. Legal and industry references

This page is not legal advice. Cyber and digital security rules in Bangladesh can change; official gazettes remain authoritative. For transparency and comparison we also point to: