MenuClose

Privacy policy

Last updated

This page explains what this site collects, why, and what you can do about it, in plain English.

Who runs this site

deepa.dev is run by Deepashree Vijaykumar (Deepa), an individual based in Sydney, Australia. When this page says I or me, that is who it means. You can reach me at hi@deepa.dev.

I decide what this site collects and why, so in EU and UK terms I am the controller of that information.

I handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and I aim to follow them even where the Act might not strictly apply to a personal site. I am not based in the EU or the UK. Because this site measures visits, the GDPR and the UK GDPR can still apply to visitors there. For those visits I follow them: nothing is measured until you agree, and the rights below are yours.

Your analytics settings

What you see first depends on where you visit from, worked out roughly from your connection.

  • Asked first. In the EU or EEA, the UK, Switzerland, Quebec, South Korea, China, Brazil and India, a banner asks before anything is measured. The same goes when your location is unknown. You can accept, reject or choose. Until you do, nothing is measured.
  • Told, with a way out. Everywhere else, a short notice says that visit statistics are on. Session replay stays off unless you allow it, and you can opt out of statistics.

If your browser sends a Global Privacy Control signal, I treat it as a choice to opt out. You can change your mind at any time with Cookies in the footer or the menu.

Visit statistics

To learn which pages people read and how they find the site, I use OpenPanel. I run my own copy of it on a server in the EU.

It sets no cookies and stores nothing on your device. To count a device, it makes a one-way hash of your IP address, your browser user agent and the site. The hash uses a salt that changes every day, so visits on different days cannot be linked. OpenPanel does not store raw IP addresses.

Your browser sends these events to deepa.dev, which passes them straight on to my OpenPanel server. They record:

  • the pages you view, and the site that referred you
  • links you follow to other sites
  • clicks on the few elements I have marked for counting
  • your browser, operating system and type of device
  • a rough location (country and city), worked out from your IP address

I also use Cloudflare Web Analytics. It is cookieless and shows only totals: page views, referring sites, countries, browsers and how fast pages loaded. It loads only when visit statistics are allowed.

Session replay

If you allow it, OpenPanel also records how a page is used: its layout, scrolling, mouse movement and clicks. I watch these recordings to see how the site is used and fix what gets in the way.

Page text shows in a recording, because it is already public. Every form field is masked in your browser before anything is sent. The admin area is never recorded.

Session replay runs only with your permission, wherever you are.

Other information

Hosting and security logs. The site is served by Cloudflare, Inc. To deliver pages and protect the site from abuse, Cloudflare processes technical request data, including your IP address, as my service provider.

Emails you send me. If you email me, I receive your email address, your name if you include it, and whatever you write. I use it only to read and reply to you, and I never sell it or share it with anyone.

The blog. Posts I publish are stored in a Cloudflare D1 database. Images I attach to a post are stored in Cloudflare R2. A published post is public. A draft stays in the database until I publish or delete it.

Missing pages. When a request asks for a page that is not on the site, I may store the path, the page that referred you, your browser user agent, and your IP address, along with how many times that path was requested and when it was last seen. I use this to find broken links. It lives in the same database as the blog, and it is not shown on a public page.

Editor sign-in. I sign in at the blog admin with a passkey. After a successful sign-in the site sets a session cookie so the admin knows it is me. A visit that only reads the site does not get that cookie.

Comments. Comments on blog posts are moderated before they appear. If you leave one, I store the name and text you write so it can be shown under the post.

What is stored on your device

Public pages set no cookies. The site may keep up to three entries in your browser localStorage:

  • motion remembers whether you switched animation on or off.
  • blob-best holds your best score, only if you play the blob game.
  • consent holds your privacy choice and when you made it. It is strictly necessary, because without it the site could not remember your answer.

None of these is sent to me or anyone else, and you can clear them at any time in your browser settings. OpenPanel keeps its identifiers in memory for the visit and writes nothing to your device. The music button remembers nothing: music is off each time you visit.

The blog admin is different, and only after an editor signs in. Signing in sets a cookie named astro-session, which identifies the signed-in editor for that browser. The admin may also keep emdash-theme, emdash-editor, emdash-toolbar-dismissed, emdash-toolbar-labels and a few other admin settings in localStorage. They remember the editor appearance and toolbar.

Who handles it, and where

  • Cloudflare, Inc. hosts the site: its network, the Worker that serves pages, and the D1 database and R2 storage behind the blog. Cloudflare runs a global network, so it may process data outside Australia, including in the United States.
  • My OpenPanel server is in the EU. Visit statistics and session recordings are stored there.

If you visit from outside the EU, your statistics are processed in the EU. Cloudflare processes data under its data processing terms and the EU standard contractual clauses, and it is certified under the EU-US Data Privacy Framework.

Why I use it

Where the law requires consent, as in the places listed above, visit statistics run only with your consent. Elsewhere I rely on my legitimate interest in understanding how the site is used, and you can opt out. Session replay always needs your consent.

How long it is kept

  • Visit statistics: 13 months.
  • Session recordings: 30 days.
  • Emails: as long as the conversation needs.

What this site does not do

  • No advertising, and no ad tech or third-party trackers.
  • No profiles of you, and no tracking across other sites.
  • No selling, renting, sharing or trading of personal information.
  • No contact forms or newsletters.
  • Comments on posts are moderated before they appear, and there are no accounts for readers. The only sign-in is the one I use to write.

Children

This site is not aimed at children, and I do not knowingly collect personal information from anyone under 16. If you think a child has sent me personal information, email me and I will delete it.

Your rights

You can ask to see the personal information I hold about you, and ask me to correct or delete it. You can object to how I use it, and withdraw consent at any time with Cookies in the footer or the menu. Email hi@deepa.dev and I will reply within 30 days.

OpenPanel stores no names and no IP addresses, so I may not be able to find your visits. If you tell me the date, rough time and pages, I will look and help where I can.

Complaints

If you are unhappy with how I have handled your information, please email me first so I can put it right. If you are still not satisfied, you can complain to a regulator:

  • in Australia, the Office of the Australian Information Commissioner at oaic.gov.au
  • in the UK, the Information Commissioner's Office at ico.org.uk
  • in the EU or EEA, your local data protection authority

Changes to this policy

If what the site collects changes, I will update this page and the date at the top. The current version always lives at this address.