Your data.

I use PostHog, on its EU cloud, to see how people find and use the site. It only runs on balbir.dev, and it loads after the page has finished loading.

• Until you choose, if you reject, or if you close the cookie card: PostHog runs without cookies. Apart from remembering a Reject, nothing is stored on your device. PostHog counts visits with a scrambled code it works out on its own servers, and removes your IP address. The site adds only your country (a two-letter code from the hosting provider), never your city or IP.
• If you accept: PostHog keeps an anonymous ID in a cookie and in local storage, so a return visit counts as the same visitor. Your IP address is used to look up your country, then discarded.

Either way it records pages viewed, clicks (for heatmaps), page speed, and a few named actions, each with only where on the site it happened:

• opening the contact form, sending a message (and its topic), and copying my email;
• opening my CV, my LinkedIn or my GitHub, and a project's live site or source code;
• opening the booking panel, and that a call was booked (which call, never your details);
• on a case study: opening “Full story” on a phone, and how far you read (25, 50, 75 or 100%, and which chapters came into view);
• which answer card opened in the command dock, and whether you typed or picked a suggestion;
• signing the guestbook, getting a passport, and picking a trip (only whether you typed a name or signed in with GitHub or Google, and which place);
• playing a film, and clicking a shop link on the uses page (and which item).

It never records what you type, including what you ask the dock, your name, your note or your email, and there are no session recordings.

Your choice is remembered in local storage. You can change it any time with “Cookie settings” at the bottom of every page.

PostHog keeps this data for up to 1 year.

The form sends your name, email, chosen topic and message to me in two ways: a Telegram message from the site's bot, and an email to my Gmail inbox. The site itself does not keep a copy.

Messages stay in my email and Telegram until I delete them. Ask me and I'll delete yours.

Calls are booked through Cal.com. Its booking card only loads when you open the booking panel, and Cal.com handles the form, the calendar invite and the emails under its own privacy policy. When you book, Cal.com tells the site, which sends me a Telegram message with your name, email and the time.

A note keeps its text and a name, and is shown publicly on the guestbook wall. You can sign with a typed name, or sign in with GitHub or Google. If you sign in, the note also keeps your account's display name, profile photo link and account ID. Notes are stored in Google's Firebase (Firestore), and sign-in is handled by Firebase Authentication, which keeps you signed in using your browser's storage.

Likes use a random ID made in your browser and saved in local storage, so each like counts once. It isn't linked to your name.

Notes and likes are kept until you ask me to remove them, or I remove them.

A passport keeps a name (typed, or from your GitHub or Google sign-in), a profile photo link if you signed in, a passport number, your stamps, the place you chose when you said "I'm in" to a trip, and the dates. Holders are shown publicly on the Places page, with their name and photo on the trip they chose (or, if they haven't chosen one, the first place they stamped). It is stored in Firebase (Firestore).

If you don't sign in, your browser keeps a secret key in local storage (places-passport-key) that proves the passport is yours; the site only keeps a scrambled copy of it. Starting over deletes the passport.

Passports are kept until you start over or ask me to remove yours, or I remove them.

To stop spam, the contact form, guestbook and passport count how often each visitor uses them. The count is stored in Firebase against a scrambled form of your IP address (mixed with a server secret), never the address itself, with the times of recent attempts. Each counter is deleted automatically about a day after it was last used.

• theme: light or dark, if you picked one.
• portfolio-intro-seen and consent-dismissed (this visit only): so the intro and the cookie card don't repeat.
• gb-visitor, gb-liked and gb-signed-in: your guestbook likes, and whether you signed in.
• places-passport-key: your passport key, if you made one without signing in.
• PostHog's record of your cookie choice and, only if you accept, its anonymous ID.
• Firebase's sign-in session, only if you sign in.

None of these are used for advertising.

These services each keep data under their own privacy policy. The ones your browser talks to directly see your IP address.

• Vercel hosts the site and keeps its request logs.
• Cal.com handles bookings, only when you open the booking panel.
• Google and GitHub handle sign-in, only when you choose to sign in.
• Last.fm tells the site what I'm listening to. The site asks it directly, so it gets no data about you.
• Apple (iTunes Search) supplies the music card's cover and its 30-second preview, which your browser loads from Apple only when you press play.
• YouTube (Google) plays the full song in its privacy-enhanced player when Apple has no preview, which your browser loads only when you press play. When a song has no other cover, the card shows its YouTube thumbnail; the site's own server fetches that image from Google, so your browser doesn't.
• Open-Meteo (the Luton weather) and GitHub (my public stats) answer questions in the command dock.
• Amazon: some links on the uses page are Amazon affiliate links. Nothing goes to Amazon unless you click one; clicking takes you to Amazon, which may set its own cookies.

To see, correct or delete anything I hold about you, email singh.techie24@gmail.com. Tell me what you used (contact form, guestbook note, passport or booking) so I can find it.