What this site records

This site keeps its own analytics rather than handing them to Google. That means a row per page view in a database I control, and it is deliberately a thin row: no cookies, no IP address, and nothing that can recognise you on a second visit.

It used to store an IP address, a city, an internet provider and a year-long identifier in a cookie. All of that is gone, because none of it was being read and keeping it made this a tracking site rather than a counter. What follows is the whole of what is left.

None. This site sets no cookies: not for advertising, not for analytics, not for anything.

There was one, _vid, holding a random identifier with a one-year expiry so repeat visits could be recognised. It was removed rather than disclosed. Nothing here needed to know you had been before, and an unconsented year-long identifier is not something an application security portfolio should be shipping.

A random id still travels with each page view, but it is generated in memory, lasts until you navigate away, and is never written to your browser. It exists so a page view and the note of how long you stayed can find each other. It cannot join two pages, and it certainly cannot join two visits.

The light or dark theme you pick is saved in your browser's local storage under theme, so the site remembers it. It never leaves your browser.

Every row holds, where the browser or the request provides it:

• The path you visited, and where you arrived from
• Your country, from an edge header. Not your city, not your IP
• Browser, operating system, device type and window width
• Your browser language and timezone
• How long you stayed on the page
• Any utm_ campaign parameters in the link you followed

It is stored in a Postgres database hosted by Supabase, in the United States, and only I can read it. It exists so I can tell whether anything here is being read, which is the whole reason it was built, and it turns out that question never needed a name attached to it.

Rows are kept for 12 months. A nightly job deletes anything older.

Your IP address is read while the request is being served, to rate limit the endpoint and to skip my own visits. It is used in memory and is not written anywhere.

OpenAI receives the text you type into either of the two tools on this site: the chat, and the fit assessment, where you paste a job description. Those are sent to the gpt-4o-mini model to produce a reply and are handled under OpenAI's terms. Neither is written to my database.

Do not paste anything confidential into either box. A job description that has not been published, or anything your employer would call internal, should not go into a text field on a stranger's website. Mine included.

EmailJS delivers the contact form. When you press send, your browser posts your name, email address and message to EmailJS, which also sees your IP address as part of that request. EmailJS forwards the message to my Gmail inbox, where it is kept like any other email. Nothing is sent until you press the button.

Vercel hosts the site and, like any web host, sees requests as they are served.

Nothing else loads from a third party. Fonts and images are served from this domain, and outside links only reach their site when you click them.

No account, because there is nothing to sign in to. No name or email unless you send one through the contact form. No advertising network, no Google Analytics, no social pixels, no fingerprinting, no session recording, and nothing recording what you type as you type it. The site is not directed at children under 13 and does not knowingly collect anything from them.

If you are in the EU or the UK, the GDPR gives you the right to see what is held about you, to have it corrected, and to have it deleted. The page view counter runs on legitimate interest (Article 6(1)(f)): knowing whether the site is read, with nothing that identifies you. A contact form message is processed so I can reply to it.

The site does not respond to Do Not Track signals differently, because there is no cross-site tracking for the signal to turn off.

For analytics, there is nothing here to find. Since no cookie is set, no IP is stored and no identifier survives a page load, no row in that table can be traced back to you, by me or by anyone with the database in front of them. That is the point of having removed them: a request I cannot fulfil because the data does not exist is a better answer than a process for handling one.

A contact form message is different: it is an email with your name on it, and I will delete it if you ask. If you want to ask anything else, or you think something here is wrong, email luis.lozoya.tech@gmail.com.

Luis Javier Lozoya, Charleston, South Carolina. This is a personal site rather than a company one, and the database sits in a personal account.

If what is recorded changes, this page changes in the same commit. The date below is when it was last true.