Privacy

This is my personal site. I keep a simple record of visits so I know which of my projects are opened, and whether a link I sent was opened.

What is recorded

• Which page sections, which parts of them (for example each part of my background or each group of skills) and which parts of a project come into view and for how long they are on screen, which one was on screen at each moment, when a project is opened and closed, how long the tab is visible, and the scroll position over time.
• While the tab is visible: whether a click, key, touch, scroll or pointer movement came within the last 10 seconds (active or idle), whether the browser window was the one in front; the times of each, not what was done.
• Clicks on links such as GitHub, LinkedIn, email or this page (and how long the page stayed in the background after one), jumps to a part of the page, opening the menu, and the project filters. When the mouse pointer is over a project card, or over the email, phone, LinkedIn, GitHub, send or "see the work" buttons, for a second or more: which one and for how long.
• Clicks or taps on parts of the page that are not links (a heading, a number, a tag), several quick presses in one spot, a right-click or a long press, zooming in or out (or the browser's zoom or the display's scaling changing), opening the print dialog, the browser's find shortcut (Ctrl+F or Cmd+F: only that it was pressed) and a translation of the page by the browser: where on the page, what kind of thing, and the zoom or the language, never any text.
• When text is selected or copied: where on the page and how many characters, and whether it contained my email address or phone number. Never the text itself.
• How long the page took to load, the network type your browser estimates (for example 4g) and whether its data saver is on, where it reports them, whether the browser restored the tab after unloading it, the app a link was opened from when an Android app says so (for example the Gmail app), a change of the window's size or shape (for example when a phone is turned), and the message of a script error on the page (with email addresses, links and numbers of 3 or more digits replaced), so a slow or broken page can be fixed.
• Whether the contact form was started and which fields were filled in, never what you typed until you send it.
• Device type, screen and window size, browser, time zone, language, the page you came from, and an approximate region (never the city) that comes from your network.

Telling visits apart from automated link checks

Many email systems open every link in a message automatically to check it for threats. To tell those visits apart, the site records simple technical facts: the headers your browser sends with the page request, whether the browser reports that it is automated, whether its graphics are software-only or a virtual machine's, the window's size around the page, counts of clicks, key presses, touches, wheel turns and pointer movement and the time of the first and last of them (counts and times only; never which keys except the find shortcut, and where the pointer went only as which card or button it was over, above), and the company that runs your network. Each page served through an email link carries a random page id, and loads a tiny image, so the server can tell a page a browser displayed from an automated download; the id is not put in your browser's storage (the page that carries it can stay in your browser's cache). The site also has a hidden link that no person can see or reach; opening it is recorded as a sign of automation.

• Your IP address is used for these checks and deleted 7 to 8 days after the visit. After that only the network's owner, the country, the region and the time zone from the IP lookup remain (never the city), and, when your address is on one of the published lists below, that list's name and the range it lists (never narrower than 256 addresses, or an IPv6 /48).
• If your browser sends Global Privacy Control, nothing is stored in your browser, and no IP address, browser id, location finer than the country, time zone or language is kept.

What your browser keeps

• A random id, so a later visit from the same browser can be told apart from a visit from another browser.
• If you came through a link in my email, the short code from that link, for 90 days, so a later visit from the same browser is also connected to that email.
• A short queue of visit data not yet confirmed as received, a marker for the current visit that ends after 30 minutes of inactivity, and a marker that you have visited before.
• For the 10 most recent visits from this browser (kept up to 90 days): each visit's random id and the link code it began with, so data left over from one visit is sent with that visit.

Links in my emails

If you arrived through a link in an email I sent you, the link carries a short code. Visits through it, and later visits from the same browser that remembers it (see above), are connected to that email, so I can see whether the link was opened, what was clicked, and whether it was used in more than one browser. Visitors without such a code are not connected to anyone.

Who else is involved

• Netlify hosts this site and handles the contact form, so it receives your requests and anything you send through the form.
• The visit records are stored in a MongoDB Atlas database.
• The owner of your network is looked up from your IP address in a network database kept on this site's own server at Netlify, and your IP address is checked against the address lists that Tor, Microsoft, Amazon, Google and Cloudflare publish. Only when that database is missing, or cannot be read within 1.5 seconds, is the owner looked up through Team Cymru's public lookup service, which then receives your IP address.
• When a visit passes the checks above (a click, or 45 seconds or more of scrolling or pointer movement), I get a short notification through Telegram (and Discord, if I use it) with what was clicked, the browser type, time zone setting and network owner, and, for a link in my email, the name of the person I wrote to and the time since I sent it; if the link is used in a second browser, the same for that browser. Never an IP address.
• To give me a short written summary of a visitor, the recorded facts of their visits (never an IP address, never anything typed) are sent to OpenAI's API when I open that visitor in my dashboard. OpenAI does not use API data to train its models.
• The page's fonts come from Google Fonts, so Google receives your IP address when it delivers them.

What is not done

• No advertising, no third-party trackers or analytics companies, no selling of data, and nothing shared beyond the services above.
• No fingerprinting: the technical checks above are never combined into an identifier for your device. No recording of the screen, of what you type before you send it, of which keys you press (beyond the find shortcut) or of the mouse path, and no tracking on any other website.

How long it is kept

IP addresses: 7 to 8 days. Records of page requests: 6 months (a visit keeps a copy of its own page request's headers, never the IP, as long as the visit record). Visit records: 400 days (about 13 months). Then they are deleted. A short summary of visits through an email I sent (whether the link was opened, what was clicked, and which project) is kept with that conversation for as long as I keep the conversation.

Your choice

If you want your visit records deleted, email devparekh@ivia.co.in and I will remove them.

Dev Parekh, Ahmedabad, India