What I collect

This is a personal portfolio. It has no advertising, no third-party analytics and no tracking cookies. I do not build profiles of visitors.

If you use the contact form, the information you submit (name, email, subject and message) is transmitted over HTTPS to the server and used only to reply to you. When email delivery is configured, it is sent through a transactional email provider and not stored on this site.

Server logs

Like almost every website, the hosting provider may record standard request metadata (IP address, user agent, timestamp) for security and abuse prevention. These logs are managed by the hosting provider and retained for a limited period.

How this site is secured

  • HTTPS enforced end to end, with HSTS and preloading.
  • A strict Content-Security-Policy with per-request nonces and strict-dynamic, plus locked-down default-src,object-src, base-uri and frame-ancestors.
  • Hardened response headers: X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin isolation and more.
  • No database and no user accounts, which removes whole classes of attacks.
  • All untrusted input is validated and rate-limited; the contact endpoint also uses a honeypot and timing checks.
  • MDX content is compiled without raw-HTML support, so articles cannot inject scripts.
  • Dependencies are pinned and audited; the production bundle ships without source maps.

Responsible disclosure

If you believe you have found a security issue, please contact me at [email protected]. Machine-readable contact details are published at /.well-known/security.txt.

Your choices

You can request deletion of any message you have sent me. Just reply to the conversation and ask.

Get in touch with any questions about this policy.