ihandpan.comby Ibi Malik

Privacy policy

How ihandpan.com handles your data — no cookies, no analytics, no accounts, and nothing requested from YouTube’s player until you press play.

Last updated 13 September 2026.

The short version. This site sets no cookies, runs no analytics and has no forms, accounts or payments. No page asks your browser to contact any other company. If videos are ever added to the lessons, YouTube will be the one exception: for the video thumbnails, and for the video player itself once you press play.

Who we are #

This website, https://www.ihandpan.com, is published by Earthas DNCS OÜ, a private limited company registered in Estonia under company number 17406676, registered office Narva mnt 5, Kesklinna linnaosa, Tallinn 10117, Harju maakond. Earthas DNCS OÜ trades as Ibi Malik.

In this policy, “we” and “us” mean Earthas DNCS OÜ. “You” means anyone reading the site or writing to us.

For the purposes of the General Data Protection Regulation (EU) 2016/679 and Estonian data protection law, Earthas DNCS OÜ is the data controller.

This policy sits alongside our terms of use.

Visiting the site #

The site is a set of static files hosted by Cloudflare Pages. There is no database, no login, no shopping cart and no form to fill in.

Like any web host, Cloudflare records each request in its server logs: your IP address, the page requested, the time, and the browser and operating system your device reports. This happens for every website you visit and is necessary to deliver pages and to defend against attack and abuse. The lawful basis is our legitimate interests in running a secure, working website (Article 6(1)(f) GDPR).

Those logs belong to Cloudflare and are held under Cloudflare’s own retention policy, which you can read at https://www.cloudflare.com/privacypolicy/. We do not download them, and we hold no per-visitor record of our own. Cloudflare’s dashboard shows us aggregate figures — how many requests a page received — which do not identify anyone.

No cookies, no analytics, no tracking #

  • The site sets no cookies. There is no consent banner because there is nothing to consent to.
  • We run no analytics — no Google Analytics, no Plausible, no Fathom, no tracking pixel of any kind.
  • There is no advertising, no affiliate links and no retargeting. We do not build profiles, and we do not sell, rent or share personal data with anyone for marketing.
  • The typefaces are self-hosted from our own server, so no request goes to Google Fonts or any other font service.
  • The Study search looks things up in a file served from our own domain. What you type into it never leaves your device.

Your “practised” ticks #

Pressing Mark as practised on a lesson makes the site remember which lessons you have ticked, by storing a short list in your browser’s local storage, on your own device. It is not a cookie, it is never sent to us or to anyone else, and it is not used to recognise you. Clear them on the Play page deletes it, and so does clearing this site’s data in your browser.

Videos #

No page on the site shows a video. If videos are ever added to the lessons, they will be hosted on YouTube, and:

Thumbnails. Pages with a video show its thumbnail image, which your browser loads from YouTube’s image server, i.ytimg.com, when the page opens. As with any image request, Google receives your IP address and the details your browser reports.

The player. The video player itself is not loaded until you press play. When you do, it loads from youtube-nocookie.com, YouTube’s privacy-enhanced mode, and from that moment Google can process data about your viewing under its own privacy policy, at https://policies.google.com/privacy. If you never press play, the player never loads.

If you write to us #

The site publishes an email address and an Instagram account. If you contact us, we hold your message and your address or handle for as long as needed to deal with what you wrote about, and to keep a sensible record of correspondence afterwards. The lawful basis is our legitimate interests in answering people who get in touch (Article 6(1)(f) GDPR), or taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) where that is what your message is about.

Email travels through our mail provider, and Instagram messages through Meta, each under its own privacy policy. We do not add anyone to a mailing list. There is no newsletter.

Who else handles data #

  • Cloudflare — hosting and delivery of the site, and its server logs.
  • YouTube (Google) — only if videos are added: video thumbnails, and the video player once you press play. Google is a separate controller for what it does with your data on its own service.
  • Our email and messaging providers — for correspondence.

We do not otherwise share personal data. There are no advertisers, no data brokers, and no payment processors, because there is nothing to pay for.

Some of these companies are outside the European Economic Area. Where personal data reaches them, transfers are made under the safeguards in Chapter V GDPR, generally the European Commission’s standard contractual clauses or an adequacy decision.

Keeping data secure #

The site is served only over HTTPS. It holds no accounts and no database, so there are no passwords or stored customer records to lose. Correspondence is held on access-controlled, encrypted storage. If you believe data has been lost or accessed without authorisation, please tell us at once at ibraheem@malik5.com.

Your rights #

Under the GDPR you have the right to ask us to:

  • give you access to the personal data we hold about you, and a copy of it;
  • correct it if it is wrong or incomplete;
  • erase it;
  • restrict how we use it;
  • transfer it to you or another controller in a portable form; and
  • stop using it, by objecting to processing carried out on the basis of legitimate interests.

These rights are not absolute. We will tell you plainly if we cannot do what you have asked, and why.

To exercise any of them, write to ibraheem@malik5.com. We do not charge for this, and we aim to reply within one month.

Complaints #

If you are unhappy with how we have handled your data or your request, you can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, at https://www.aki.ee/en. You may also complain to the supervisory authority in the EU country where you live.

The site links to other websites, including handpan makers and the sources mentioned in the Study section. We do not control those sites and are not responsible for them. Their privacy policies, not this one, govern what they do.

Changes of ownership #

If the business or part of it is ever sold or transferred, personal data relevant to the transferred part may pass to the new owner, who would be bound by this policy until it told you otherwise. We would take steps to protect your privacy in any such transfer.

Changes to this policy #

We update this policy when what the site does changes, or when the law does — including if videos are ever added. The date at the top is when it last changed. Material changes will be described here rather than made quietly.

Governing law #

This policy is governed by the law of Estonia and of the European Union, and disputes arising under it are subject to the jurisdiction of the Estonian courts. This does not affect your right to complain to a supervisory authority or to bring a claim where you live.

Contact #

Earthas DNCS OÜ, Narva mnt 5, Kesklinna linnaosa, Tallinn 10117, Estonia. Email ibraheem@malik5.com.