What this site records

Every page view records the path, the referring site, a two-letter country code, whether the device is a phone, tablet or desktop, how far down the page you scrolled, how long the page was in the foreground, and which links you clicked. This is recorded on my own server. Nothing is sent to anyone else.

To count visitors without cookies, your IP address and browser user-agent are combined with a random secret that is generated fresh every day, hashed, and the result stored. The IP address and user-agent themselves are never written down. The daily secret is deleted after two days, which means the identifier for today cannot be linked to the identifier for yesterday, even by me. The practical effect: if you visit on Monday and again on Friday, you are counted as two different people, and there is no way to discover otherwise.

Nothing is stored on your device. No cookie, no local storage. That is why there is no consent banner on this site: under the UK Privacy and Electronic Communications Regulations, the consent requirement is triggered by storing or reading information on your device, and this does neither.

Traffic that identifies itself as a bot or link preview fetcher is discarded before anything is written.

Downloading a CV records which of the two CVs it was, the time, the referring page and your browser user-agent.

If you open the chat console and ask it something, the question and the first 200 characters of its answer are stored, along with a random id for that conversation. Please do not type anything into it you would not want kept. Your message is also sent to Groq, which runs the language model that answers it.

The name, email address, subject and message you submit are emailed to me and stored. That is the whole point of the form, and it is kept until I no longer need it.

• Individual analytics events and visit trails: 90 days, deleted automatically.
• Daily and per-page totals: kept indefinitely. These contain no identifiers of any kind.
• The daily hashing secret: deleted after two days.
• CV download records, agent conversations and contact messages: kept until no longer needed.

For analytics, the lawful basis is legitimate interests: understanding whether anything on a personal portfolio is being read, using the least identifying method I could build. For the contact form, it is your own request to be contacted back. There is no profiling, no automated decision-making, and no advertising.

You can ask what is held about you, ask for it to be corrected or deleted, or object to the analytics entirely. Email hammadahmad.ml@gmail.com.

Be aware that the analytics data is genuinely not linkable back to you: there is no account, no cookie and no stored IP address, so in most cases I will have no way to find your records even if you ask. That is a deliberate design choice rather than an evasion.

If your browser sends a Global Privacy Control or Do Not Track signal, the site records nothing at all for your visit. You can also block the request to /api/analytics and the site will work exactly as before.