The short version. This site collects very little. The free tools store your answers against a random token in your browser, never your name or your email, so I cannot tell who you are from them. The contact form collects what you type into it. Optional cookies are off unless you turn them on. You can see and delete everything held about you at any time, without asking me.
Last updated: 28 July 2026
Who is responsible for your data
This site is run by Tahir Shahzad, an independent product management consultant based in Islamabad, Pakistan. I am the data controller for everything described here, which means I decide what is collected and why.
For anything to do with your data, use the contact form. It reaches me directly and I answer these myself. If the form will not work for you, for any reason at all, message me on LinkedIn instead. A request about your own data should never fail because a form got in the way.
What is collected, and why
The free tools
The Ikigai Finder, the Product-Market Fit Diagnostic and the Agency Red Flag Checklist all work the same way. When you start one, your browser is given a random token. Your answers are stored against that token so the tool can score them, show you a result, and let you come back to a half-finished attempt.
Stored alongside your answers are the name of your browser, and a one-way cryptographic hash of your IP address. A hash cannot be reversed back into the original address; it exists so that abuse and automated submissions can be spotted without keeping the address itself.
No name, email address or any other identifying detail is collected by the tools. Attempts you abandon part way through are saved too, so that you can resume them.
The contact form
If you get in touch, I collect whatever you put in the form, normally your name, your email address and your message. It is stored in this site’s own database and emailed to me so I can reply. It is used to answer you and, if we end up working together, to carry on that conversation. It is not added to a mailing list and it is not sold or shared with anyone for marketing.
Spam protection
The tools and forms are protected by Google reCAPTCHA v3, which decides whether a submission is likely to be automated. It runs on pages carrying a tool or a form and sends technical information about your visit, including your IP address and how you interact with the page, to Google. Google’s own privacy terms apply to that. Without something like it, these forms fill up with automated junk within days.
Statistics
Jetpack, made by Automattic, records aggregate visit statistics such as which pages are viewed and roughly where visitors come from. I use it to see which writing is worth doing more of.
The legal basis for each of these
| What | Basis |
|---|---|
| Running a tool and showing you your result | Necessary to provide something you asked for |
| Replying to your enquiry | Steps taken at your request before any agreement |
| Spam protection and rate limiting | Legitimate interest in keeping the site usable |
| Aggregate statistics | Legitimate interest in understanding what is read |
| Optional cookies | Your consent, and nothing else |
| Keeping a record of your cookie choice | Legal obligation to demonstrate consent |
How long any of it is kept
| What | Kept for |
|---|---|
| Completed tool submissions | 12 months |
| Abandoned or partial attempts, and anything flagged as spam | 30 days |
| Record of your cookie choice | 12 months |
| Contact form enquiries | 12 months |
Deletion is automatic and permanent. Nothing is moved to a recycle bin first. The clock runs from when a record was last touched, so an attempt you are still working through will not disappear underneath you.
Who else handles it
I do not sell data or share it for anyone else’s marketing. Most of what this site holds never leaves it: the tool answers and your contact form message sit in the site’s own database and go nowhere else. These providers handle some of it purely in order to run the site:
| Who | What for |
|---|---|
| My hosting provider | Running the site and storing its database |
| Automattic | Jetpack statistics and security |
| Cloudflare | Delivering the site, and filtering automated traffic before it reaches the server |
| reCAPTCHA spam protection, and delivering contact form messages to my inbox |
Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
ts_tools_sid | Links you to your own tool answers so you can resume them | 30 days from last use |
ts_tools_consent | Remembers your cookie choice so you are not asked repeatedly | 6 months |
Both of these are necessary for the site to work as described, so they are set without asking. The second one exists precisely so that a refusal is remembered; without it the banner would reappear on every page.
Anything optional, such as recording which referral brought you here, is only ever set if you agree to it. The site works exactly the same if you refuse, and refusing is one click. WordPress, Jetpack and reCAPTCHA may set cookies of their own under their own terms, and Cloudflare may set one if it needs to check whether a visitor is a person or a bot.
You can change your mind at any time:
Cookie preferencesSeeing and deleting what is held about you
Because the tools identify you only by the token in your browser, the quickest route is to do it yourself, without contacting me and without proving who you are. Visit your data from the same browser you used the tools in. You will see everything held against it, you can download a copy as a file, and you can delete all of it permanently.
For anything the contact form holds, send me a message through the contact form and I will deal with it. Tell me the email address you originally wrote in, since that is what I search on.
Your rights
Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how it is used, and to receive it in a portable format. You will never be treated differently for exercising any of them.
One honest limitation
The tool records contain no name and no email address. If you ask me to delete your answers, I have genuinely no way of working out which records are yours, because there is nothing in them to match against you. I am not required to collect extra information about you just to make that possible, and I would rather not.
This is why the self-service page above exists, and why it is the better route. Your browser holds the only key, which means you can use it and I cannot.
Where your data goes
I am based in Pakistan, and the companies listed above operate internationally, so data may be processed outside your own country. Where that applies I rely on the safeguards those providers publish for international transfers.
Keeping it safe
The site runs over an encrypted connection. IP addresses are stored only as one-way hashes, never in readable form. Access to the database is limited to me and the hosting provider. No system is perfect, and if something does go wrong that puts you at risk, I will tell you and the relevant regulator within the time the law allows.
Children
This site is aimed at founders, product people and business owners. It is not directed at children, and I do not knowingly collect anything from them.
Changes
If what is collected or who processes it changes in a way that matters, I will update the date at the top and ask for your cookie choice again rather than assuming an old answer still stands.
Complaints
If you think your data has been mishandled, please tell me first through the contact form and I will try to put it right. If you are in the UK or the European Economic Area, you also have the right to complain to your national data protection authority, and you do not have to come to me first.