Privacy Policy

donray.dev runs its own first-party analytics. When you load a page, the site records the page path, the time of the visit, and a salted SHA-256 hash of your IP address combined with your browser's user agent string. That hash is how unique visitors are counted: it lets the site recognize a returning visitor without ever storing who they are.

That is the full extent of it. There are no user accounts, no login, no comments, no newsletter, no contact forms, and no e-commerce. Clicking an email link opens your own mail client; the site itself collects nothing from that interaction.

No cookies are set for analytics or tracking. No raw IP addresses are stored by the application. No names, email addresses, or other personal details are collected through the site itself. The analytics cannot be reversed to identify you: a salted hash is a one-way fingerprint, and the salt is never published.

The analytics exist for one reason: to understand readership. The counts power the public dashboard at /analytics, which shows total page views and unique visitors per page. Nothing is collected for advertising, and nothing is sold or shared with data brokers.

Visitor hashes are kept permanently. That is what makes the unique count honest: a visitor who returns a year later still counts once, because their hash is still in the set. Page view totals are also kept permanently. If you would like your hash removed from the set, contact me at the email below and I will remove what can be identified; note that because hashes cannot be reversed, removal works best when you can describe the approximate time and pages of your visits.

The site is hosted on AWS Amplify with DNS through Amazon Route 53. As the hosting provider and DNS operator, Amazon may log request data (such as IP addresses) under its own privacy policies, independent of anything described here. No other third-party analytics, advertising, or tracking services run on this site.

If you are in the EU or UK, you have rights over your personal data under the GDPR, including the right to access it, to have it deleted, and to object to its processing. Because the analytics store only a salted hash rather than your IP address directly, the practical scope of these rights is narrow, but the rights still apply. To exercise them, or to ask any privacy question, email me and I will respond.

This site is a personal technical blog and portfolio. It is not directed at children under 13, and I do not knowingly collect personal data from children.

This policy may change as the site evolves. When it does, the effective date at the top of this page will be updated. Significant changes will also be noted on the site itself.