Privacy Policy

How this site handles data — plainly and transparently

This is a personal portfolio and technical blog. There is no commerce, no account system, and no user-generated content beyond the contact form. This policy documents exactly what happens to data in plain terms.

01 Data Collected

Data Type Source Purpose Storage
Page views, referrer, approximate location, browser/device Google Analytics 4 Understand which content is useful Processed by Google Analytics
Name, email, message Contact form submission Respond to enquiries Server database
IP address, request path, timestamp Server access logs Security monitoring & debugging Server logs
Hashed IP address and submission count Contact form rate limiting Reduce spam and abusive submissions Temporary in-memory cache

02 What Is Not Collected

  • No visitor account credentials — this site does not offer visitor accounts.
  • No payment information — there is nothing to purchase.
  • No advertising or remarketing tags are included in the site code.
  • No fingerprinting code is included in the site code.

03 Google Analytics

This site uses Google Analytics 4 to understand site usage. It may collect page views, referrer, approximate location, and browser/device information, and may use cookies to distinguish users and sessions. Individual IP addresses are not available in this site's Analytics reports.

You can opt out using the Google Analytics Opt-out Browser Add-on .

04 Contact Form Data

Messages submitted via the contact form are stored in a server-side database. They are used only to respond to enquiries and are not sold or used for advertising. To request access, correction, or deletion of a message you sent, use the contact page.

05 Cookies

  • Analytics cookies — Google Analytics may set _ga and related first-party cookies to distinguish users and sessions.
  • CSRF cookie — may be set to protect form submissions from cross-site request forgery. It is not used for tracking.
  • Theme preference — your light or dark theme choice is stored in your browser's local storage, not in a cookie.
  • You can block or delete cookies in your browser, although the contact form may require the CSRF cookie to submit successfully.

06 Third-Party Links

Blog posts and project pages may contain links to external websites. This policy applies only to this site. Linked external sites have their own privacy practices and this site takes no responsibility for them.

07 Infrastructure

  • Hosting: VPS with a standard web stack behind a reverse proxy.
  • TLS: Valid TLS certificate — all traffic is encrypted in transit.
  • Static assets: Served from the same origin with content-hashed names and long-term cache headers.
  • Security headers: Strict-Transport-Security, Content-Security-Policy, Permissions-Policy, and X-Frame-Options are set on every response.

08 Your Rights

You may request access to, correction of, or deletion of any personal data held about you (contact form submissions). Use the contact page to make such a request.

09 Changes

This policy may be updated when site functionality changes. Significant changes will be noted in the blog.

Security Policy → Responsible Disclosure →