Privacy Policy
The short version: I collect very little, store it carefully, and never sell it. The long version follows.
Last updated: September 29, 2026
What this site is
This is a personal portfolio and blog at ajoroby.is-a.dev. The site has a guestbook and a blog comments section, both of which require signing in with GitHub or Google to leave a message, post a comment, or like an entry. Everything else, including blog posts, reactions, projects, and the resume, is fully public and requires no account.
There's no newsletter. If you want new posts, the RSS feed at /feed.xml is a plain file your reader fetches, and nothing about who subscribes is recorded.
What data is collected
Blog read counts
When you visit a blog post, a hashed version of your IP address is stored alongside the post to count unique reads. The hash is one-way (SHA-256 with a server-side salt). Your actual IP is never stored and cannot be reverse-engineered from it. There is one row per post per hash, so reloading a post doesn't count twice.
Reactions and mood votes
If you click one of the reaction buttons on a blog post, your choice (one of: Not for me, Meh, Liked it, Loved it) is stored with the same hashed IP and post pair. Reactions are fully voluntary. If you don't click anything, nothing is stored.
Short link clicks
Following a short link (any ajoroby.is-a.dev/<slug> that redirects somewhere else, or the same slug on the separate short-link domain that points at this site) adds one to a counter on that link. No IP address, hash, account, or per-click timestamp is recorded, so the number says how many times a link was followed and nothing about who followed it.
Guestbook entries & likes
If you sign in and leave a guestbook message, the following is stored in the database: your account ID, your message text, and a timestamp. If you like an entry, your account ID and the entry ID are stored. Entries removed during moderation are soft-deleted: hidden from the page but kept in the database until you ask for them to be erased. Your name and profile picture are saved together with your entry at the time you post, so the guestbook keeps showing who wrote what even if you disconnect your account later. Both actions are fully voluntary. If you don't sign in, nothing is stored.
Blog post comments & comment likes
If you sign in and post a comment on a blog post, the following is stored in the database: your account ID, your comment text, the post it belongs to, an optional parent comment ID (for replies), and a timestamp. If you like a comment, your account ID and the comment ID are stored. Deleted comments are soft-deleted: the text is hidden but the record is kept so the reply thread stays intact. Full deletion is honoured on request (see Your rights below). Your name and profile picture are saved together with your comment, not fetched from elsewhere when rendering. Both actions are fully voluntary. If you don't sign in, nothing is stored.
What is not collected
There is no browser fingerprinting, no tracking pixels, and no third-party ad networks. No email addresses or passwords are stored in this site's own database, because sign-in happens directly with the OAuth provider you choose (GitHub or Google) — this site never sees your password (see Third-party services below). If you never sign in to the guestbook or comments, no personally identifiable information about you is stored anywhere by this site.
Stored in your browser
A few preferences live in your browser's localStorage and are never sent to this site's server: your theme choice (light, dark, or system), the spot you last dragged the floating quick-menu button to, and, once you've played a video in a post, the player's volume, mute, and subtitle settings. A session cookie is set only after you sign in, to remember that you're signed in. Clearing this site's data in your browser removes all of it.
This site sets no cookies of its own beyond that session cookie, and no tracking or advertising cookies at all.
Where data is stored
Read counts, reactions, and short-link counters are stored in a PostgreSQL database hosted on Neon. These records contain no personal information, only post references, IP hashes, moods, counts, and timestamps.
Guestbook entries, likes, blog comments, and comment likes are all stored in the same Neon PostgreSQL database. These records contain your account ID, message or comment text, the post they belong to, and timestamps. Your account ID is an opaque identifier assigned by the sign-in provider, not your email, name, or any other human-readable detail. The display name and avatar shown next to your words are saved with your entry at posting time, not in a separate profile store.
Analytics
This site uses Umami Analytics, a privacy-focused, open-source analytics tool hosted on Umami Cloud. Umami does not use cookies, does not collect personal data, and complies with GDPR, CCPA, and PECR. Only anonymized, aggregated page view data is recorded, with no IP addresses, no fingerprinting, and no cross-site tracking. The script and the events it sends are proxied through this domain, so your browser never connects to Umami directly.
Third-party services
Hosting
The site runs on Vercel. Like any host, Vercel handles each request, including your IP address and user agent, in order to serve the page, and keeps short-lived request logs for operating the platform. This site doesn't read those logs for anything beyond debugging.
Sign-in (OAuth)
Sign-in for the guestbook and blog comments goes directly to GitHub or Google — there is no middle layer. When you sign in, the provider shares your name, email address, and profile picture with this site so it can show who wrote what. Your password never touches this site. Each provider's handling of your data is covered by its own privacy policy.
This site keeps you signed in with an encrypted session cookie. It exists for authentication only, not for advertising or analytics.
Profile pictures next to comments and guestbook entries were provided by you at posting time and load directly from the provider's image CDN (such as GitHub or Google avatars). That includes the guestbook preview on the home page, so viewing the home page, the guestbook, or a post with comments lets that image host see your IP address and user agent, the way any image host does. To stop sharing new data, disconnect this site in your GitHub or Google account settings.
Cloudinary
Video in blog posts streams directly from Cloudinary. Playing one connects your browser to Cloudinary, which sees your IP address and user agent the way any site you visit does. Images inside posts are handled differently: they are optimised and served from this domain, so reading a post involves no Cloudinary request until you press play.
Fonts & GitHub
Fonts are self-hosted. They are downloaded at build time and served from this domain, so your browser never contacts Google to render this page. The resume is fetched from GitHub Releases by the server and passed through /api/resume, and the repository card in the quick menu is read from GitHub's API on the server and cached, so GitHub never sees your request for either.
Your rights
If you have never signed in to the guestbook or comments, the only data stored is an irreversible IP hash, and there is no practical way to identify or retrieve those records.
If you have signed in and left a guestbook message, posted a comment, or liked either, you can ask for that data to be erased by emailing robyfull.dev@gmail.com. To remove your words from this site, email robyfull.dev@gmail.com. You can also disconnect this site from your GitHub or Google account settings at any time to stop sharing new data; entries you already posted stay until you ask for them to be erased. Depending on your jurisdiction, you may have rights to access, correct, or erase your personal data under laws such as GDPR (EU), CCPA (California), or India's DPDP Act.
Changes to this policy
When something meaningful changes, like a new third-party service or a new kind of data, this page is updated and the “Last updated” date moves with it. Every past version is public in the repository history.