DATA NOTICE
KODYBROWN.ME — WHAT IS RECORDED, AND WHY
This is a one-person portfolio site. It measures how people find
it and how far they read, using a cookieless analytics tool. It does not run ads, does
not sell anything, and does not sell or share data with advertisers or data brokers.
01 — Who is responsible
Kody Brown, San Mateo, California, USA. I am the sole operator of this
site and the controller of the data described here. The contact route for anything on
this page is the transmittal form on the main page.
02 — What is recorded
Analytics is PostHog, configured to send only events I
wrote by hand. There is no automatic click, form, or keystroke capture, and no session
replay. Each event carries:
- Page views — the page URL and title, the referring URL and domain,
and any
utm_* campaign parameters in the link you arrived on. This is how
I tell a LinkedIn visit from a search-engine visit.
- Engagement events — which sections scrolled into view, scroll depth
(25 / 50 / 75 / 100%), which hero phase was reached, interactions with the live
demos (moving the beam sliders, drawing in the sketch demo), opening the resume
request form, resume downloads, and clicks on outbound links.
- Time on page — a page-leave event, which yields how long the visit
lasted.
- Device and browser — browser and operating system, device type,
viewport size, language, as reported by your browser.
- Approximate location — PostHog derives an approximate location
(roughly country / region / city) from your IP address at the point the event is
received, and stores the IP address with the event. I do not use it to identify
individuals.
03 — What is not done
- No cookies, no localStorage. The analytics client is set to
memory-only storage. The identifier attached to a visit exists in the page's memory
and is gone when you close the tab. Nothing is written to your device, which is why
you were not shown a cookie banner.
- No fingerprinting — no canvas, font, or device-fingerprint
techniques, and no attempt to re-identify an anonymous visitor.
- No cross-site tracking — no advertising pixels, no third-party ad
or social trackers, no data brokers. Nothing here follows you to other sites.
- No session recording, no heatmaps, no keystroke capture.
- No automated decision-making or profiling that produces legal or
similarly significant effects.
04 — Why
I am a working engineer and this site is how I present that work. I want
to know which channels bring people here, which projects hold attention, and whether the
site is doing its job. The lawful basis is my legitimate interest in understanding and
improving my own site (GDPR Art. 6(1)(f)); the processing is limited to what that needs,
and it is not used to make decisions about you. You can object at any time — see
section 09.
05 — The contact form
If you use the transmittal form, the name, email address, and message you
type are sent to my personal inbox by email (delivered through Resend,
an email API provider). I read and reply to them myself.
- On a successful send, the visit's analytics identifier is linked to the
email address you provided, so I can see what you looked at before writing.
The form says so at the point of submission. Your email address and the domain part
of it (which usually indicates an employer) are stored alongside that record.
- The notification email includes that analytics identifier so I can find the
corresponding visit.
- Your message is not added to a mailing list and is not shared with anyone.
06 — The resume download
The resume PDF is not a public file. It is served only by a short-lived
signed link issued after the request form, so what you fill in there is what makes the
download happen. The name, work email, company, and any role or note you add are emailed
to my personal inbox through Resend, exactly as with the contact form.
- The visit's analytics identifier is linked to the email address you
provided, and your name, email, the domain part of it, and your company are
stored on that record. This tells me which companies are reading the resume.
- The request is not added to a mailing list, not put into any
sequence, and not shared with or sold to anyone. There is no third-party lead tool
behind this form.
- The form also stores nothing on your device — no cookie is set to remember that you
downloaded it, so the form appears again on a later visit.
- If you would rather not hand over an address at all, message me any other way and I
will send the PDF back myself.
07 — Who processes it
- PostHog Inc. (United States) — product analytics. Events are sent
to PostHog Cloud US and stored on infrastructure in the United States. Their notice:
posthog.com/privacy.
- Resend (United States) — transactional email delivery for
contact-form messages and resume requests.
- Vercel Inc. (United States) — hosting. Vercel keeps its own
operational server logs of requests to this site.
If you are in the EEA or UK, this means your data is transferred to and
stored in the United States by those providers under their own transfer mechanisms.
08 — How long it is kept
Analytics events are retained under PostHog Cloud's standard retention for
my project — currently up to seven years for raw event data — unless I delete them
sooner. Contact-form messages and resume requests stay in my email inbox until I
delete them; I do not maintain a separate database of them. Ask and I will delete either.
09 — Turning it off
If your browser sends Do Not Track or a Global
Privacy Control signal, the analytics script is never downloaded and no events
are sent. Any content blocker that blocks PostHog has the same effect. Nothing on this
site breaks when analytics is blocked. This page itself runs no scripts at all.
10 — Your rights
Depending on where you live, you may have the right to access, correct,
delete, or export the data described here, to object to it, and to complain to a data
protection authority. Send the request through the
transmittal form — or, if you would rather not use it,
reach me on LinkedIn.
I handle these myself, so tell me roughly when you visited and I will find and remove
the records.
11 — Changes
If what this site records changes, this page changes with it and the
effective date at the top is updated. There is no archive of prior versions.
← BACK TO THE SITE