Privacy Policy

Last updated: 14 September 2026

This is my personal website. I'm Karthikeyan, and I run it myself. This policy explains what information the site handles, what is sent to Google Analytics, and what you can do about it. It covers this website only. Other sites I link to, such as SparkTribe or my social profiles, have their own policies.

• If you send a message through the contact form, the site stores it so I can read it and reply.
• The site uses Google Analytics 4 to see which pages people visit and read. Your name, email address and message are never sent to Google Analytics.
• If your browser sends Global Privacy Control, Google Analytics doesn't load at all.
• The site sets no cookies of its own for visitors. Google Analytics sets two cookies when it runs.

When you send a message from the contact page, the site stores:

• your name and email address
• the topic you chose, if any
• your message, and when you sent it
• two technical details used to stop spam and abuse: your browser's user-agent string (which identifies your browser and device type) and a scrambled, one-way hash of your IP address. Your actual IP address is not stored.

Messages go to a private inbox on this site that only I can access. They aren't forwarded by email, added to a mailing list, sold, or used for marketing. I use your email address only to reply to you.

Messages aren't deleted automatically: a message stays until I delete it. If you want a message you sent deleted, ask me through the contact page.

Like any website, this one receives technical information whenever your browser loads a page, such as your IP address, your browser type and the page requested. This is needed to deliver pages and keep the site secure and working.

• The site is hosted on Vercel, its database runs on Supabase, and images are served from Cloudflare R2. These providers handle this information to run their services and may keep it in their own logs, under their own policies.
• Your IP address is used briefly to limit abuse, such as too many messages or searches in a short time. The site's database only ever holds the scrambled hash, never the address itself.
• If you choose light or dark mode, your choice is saved in your browser's local storage. It stays on your device.

This happens whether or not analytics is running, and the site doesn't pass any of it to Google Analytics. What Google Analytics collects on its own is described below.

Some pages may include videos or other content from YouTube, Vimeo, CodePen, Spotify or Loom. These load only when you press play or click to load them. Until then, a YouTube video shows a preview image loaded from YouTube's servers. When you play a YouTube video, it loads from YouTube's privacy-enhanced domain (youtube-nocookie.com). Once any embed loads, it comes directly from that provider, and their privacy policy applies.

I use Google Analytics 4, a service from Google, to understand how many people visit, how they find the site, and which content they find useful. The reports live in my Google Analytics account. The site has no analytics database of its own.

When Google Analytics runs, it records:

• Page views: the page address, the page title, and the page you came from. The address includes anything after a "?", such as the words you search for on the site's search page, or campaign tags in a link you followed to get here.
• Content views: when you open an article, guide, note, project, video or other piece of content, it records the content's type, title and short URL name.
• Reading progress: on longer articles, whether you've scrolled past 25%, 50%, 75% and 90% of the text. Each point is recorded at most once per page view. Exact scroll positions aren't recorded.
• Link clicks: when you click a link to another website, including a project's live site or source code, one of my social profiles, or SparkTribe, it records that site's domain and page path.
• Contact interactions: when you click a link to the contact page, or an email or phone link, it records which of those three it was. When a contact form message is sent successfully, it records only that a message was sent.

Google Analytics also collects some information on its own on every page: approximate location (country, region and city) worked out from your IP address, device type, browser, operating system, screen size, language, and how long you spend engaging with pages. Google says Google Analytics 4 doesn't log or store IP addresses.

I use this to see which pages get read, whether people finish them, how visitors find the site, and whether links and the contact form work. I don't use Google Analytics for advertising, and I don't try to identify individual visitors. Because analytics data isn't tied to names or email addresses, I can't look up what a particular person did on the site.

Google processes this data under its own terms. See how Google uses information from sites that use its services.

Google Analytics loads only on the site's public pages. It never loads in the private admin area or on draft previews.

Separately, I use Google Search Console to see how the site appears in Google Search. It works from Google's own search data and adds no scripts or cookies to this site.

• Anything you type into the contact form: your name, email address or message. Only the fact that a message was sent.
• Email addresses and phone numbers from email or phone links. Only whether it was an email or a phone link.
• The query string or fragment (the part after "?" or "#") of links to other websites. Only the domain and path are sent.
• Private pages, drafts, previews and the admin area. These pages don't load Google Analytics.

The site sets no cookies of its own for visitors. (A sign-in cookie exists only for the private admin area, which only I use.)

When Google Analytics runs, it sets two first-party cookies, meaning cookies that belong to this site's domain:

• _ga holds a randomly generated identifier, so return visits from the same browser can be counted.
• _ga_<ID>, where <ID> is this site's Analytics measurement ID, keeps track of your current visit (session).

By Google's default, these cookies last up to two years and are renewed each time you return. Some browsers delete them sooner. They don't contain your name or email address.

If Google Analytics doesn't load, for example because your browser sends Global Privacy Control, these cookies aren't set.

Global Privacy Control (GPC) is a signal your browser can send to tell websites you don't want your data sold or shared. Some browsers send it by default or have a setting for it, and browser extensions can add it.

If your browser sends GPC, this site doesn't load Google Analytics: no Google Analytics script is requested, no analytics cookies are set and no analytics events are sent. The site checks for GPC when a page first loads, so if you turn it on while browsing, it applies from your next page load or refresh. Analytics cookies from an earlier visit stay in your browser until they expire or you delete them, but nothing is sent to Google Analytics while GPC is on.

The site doesn't respond to the older "Do Not Track" setting. Use GPC instead.

There's no cookie banner on this site. These are the controls that work:

• Turn on Global Privacy Control in your browser or with an extension. Google Analytics then won't load on this site.
• Install Google's Analytics opt-out browser add-on, which stops Google Analytics from sending data from any website you visit.
• Use a content or tracker blocker. Many of them block Google Analytics.
• Block or delete cookies in your browser settings. If you block this site's cookies, Google Analytics can't recognise your browser on return visits. Deleting them resets the identifier.

If you have a question about this policy, or want a message you sent deleted, get in touch through the contact page.

I'll update this policy when the site's data practices change, for example if I add or remove a service or change what analytics records. The "Last updated" date at the top shows when it last changed.