What this site records

This site keeps its own analytics rather than handing them to Google. That means a row per page view in a database I control, and it is deliberately a thin row: no cookies, no IP address, and nothing that can recognise you on a second visit.

It used to store an IP address, a city, an internet provider and a year-long identifier in a cookie. All of that is gone, because none of it was being read and keeping it made this a tracking site rather than a counter. What follows is the whole of what is left.

None. This site sets no cookies: not for advertising, not for analytics, not for anything.

There was one, _vid, holding a random identifier with a one-year expiry so repeat visits could be recognised. It was removed rather than disclosed. Nothing here needed to know you had been before, and an unconsented year-long identifier is not something an application security portfolio should be shipping.

A random id still travels with each page view, but it is generated in memory, lasts until you navigate away, and is never written to your browser. It exists so a page view and the note of how long you stayed can find each other. It cannot join two pages, and it certainly cannot join two visits.

Every row holds, where the browser or the request provides it:

• The path you visited, and where you arrived from
• Your country, from an edge header. Not your city, not your IP
• Browser, operating system, device type and window width
• Your browser language and timezone
• How long you stayed on the page
• Any utm_ campaign parameters in the link you followed

It is stored in a Postgres database hosted by Supabase, in the United States, and only I can read it. It exists so I can tell whether anything here is being read, which is the whole reason it was built, and it turns out that question never needed a name attached to it.

Your IP address is read while the request is being served, to rate limit the endpoint and to skip my own visits. It is used in memory and is not written anywhere.

OpenAI receives the text you type into either of the two tools on this site: the chat, and the fit assessment, where you paste a job description. Those are sent to the gpt-4o-mini model to produce a reply and are handled under OpenAI's terms. Neither is written to my database.

Do not paste anything confidential into either box. A job description that has not been published, or anything your employer would call internal, should not go into a text field on a stranger's website. Mine included.

Vercel hosts the site and, like any web host, sees requests as they are served.

No account, because there is nothing to sign in to. No contact form, so no name or email unless you choose to send one. No advertising network, no Google Analytics, no social pixels, no fingerprinting, and nothing recording what you type as you type it.

If you are in the EU or the UK, the GDPR gives you the right to see what is held about you, to have it corrected, and to have it deleted.

There is nothing here to find. Since no cookie is set, no IP is stored and no identifier survives a page load, no row in that table can be traced back to you, by me or by anyone with the database in front of them. That is the point of having removed them: a request I cannot fulfil because the data does not exist is a better answer than a process for handling one.

If you want to ask anyway, or you think something here is wrong, email luis.lozoya.tech@gmail.com.

Luis Javier Lozoya, Charleston, South Carolina. This is a personal site rather than a company one, and the database sits in a personal account.

If what is recorded changes, this page changes in the same commit. The date below is when it was last true.