Privacy

This site runs its own self-hosted analytics and security logging instead of Google Analytics or any third-party tracker -- no ad networks, no marketing pixels, no cookie consent banner, because there's nothing here that needs one. Everything described below lives in a Supabase database Oliver controls directly. It exists to answer "who's visiting my site" and "is anyone attacking it," not to build a profile to sell anything.

Every page view records: the path, referring page, browser/OS (from your User-Agent), screen width, browser language, how long you stayed, and your IP address -- both a raw copy and a salted one-way hash. Country/region/city are derived from your IP by Vercel's edge network, not looked up separately.

The raw IP is a deliberate exception to an otherwise hash-only design: every other table on this site stores only the salted hash, but page views keep the real address too so Oliver can see it directly in his own admin dashboard. If the database were ever breached, this is the one place real visitor IPs would be exposed -- accepted knowingly, not accidentally.

Name, email, and whatever you write get stored, along with your IP hash and User-Agent, so Oliver can reply to you and so spam/abuse can be traced back to a source.

This site runs decoy paths and pattern-matches for common attack payloads (SQL injection, XSS, and similar). Tripping one logs the path, IP, User-Agent, and which attack category matched, and blocks the source from the rest of the site. If that applies to you, you already know, and you've read the joke response.

For a visitor flagged as suspicious, this site looks up their IP's ISP, organization, and whether it's a known VPN/proxy or hosting provider, via ip-api.com (a free, third-party IP geolocation service). That lookup is cached for 30 days. This is the only place on this site where a visitor's IP address is sent anywhere outside Supabase (the database) and Vercel (the host) -- and it only happens for flagged, suspicious traffic, not ordinary visitors.

Regular visitors get none. The only cookie this site sets is a signed session cookie for Oliver's own admin login, scoped to /admin, and it's never set unless someone successfully authenticates with a password and an authenticator code.

Understanding real traffic to this site, replying to contact form messages, and detecting/blocking abuse. It is never sold, never shared with advertisers, and never used for anything beyond running this site.

Honeypot/attack logs older than 90 days can be purged from the admin dashboard. Page views and contact submissions are kept indefinitely for now (this is a personal portfolio site with modest traffic, not a service processing data at a scale where retention limits are load-bearing) but are never used to build profiles that leave this database.

Want your data removed? Email oliverstraus@proton.me and it will be deleted.