Privacy, in plain words.
No cookies unless you say yes, and no banner in your way. Here is exactly what this site collects, why it collects it, and how to make me delete it.
Last updated · 23 October 2026
Who is responsible for your data
This site is run by Shivam Bhadoriya, an independent developer based in Navsari, Gujarat, India. There is no company, no data-processing department and no third party managing this on my behalf.
If you want anything on this page explained, corrected or acted on, write to contact@shivambhadoriya.com and it reaches me directly.
No cookies unless you turn on visit insights
No advertising cookies, no tracking pixels, no Google Analytics, no Meta pixel, no third-party trackers of any kind. If you never press “Allow selected” on the visit-insights card, this site sets no cookies at all.
Two things are stored in your own browser and never sent anywhere: your light or dark theme choice, and your answer to the visit-insights card, so you are not asked again. A “No thanks” is remembered for 180 days and then forgotten. Clearing your browser data removes both, and nothing breaks.
If you do allow visit insights, two cookies are set: sb_vi, a random identifier for this browser that lasts at most 22 days, and sb_vi_s, which ends when you close the browser. Page scripts cannot read either one, and neither contains anything about you.
What I collect when you use the contact form
If you send an enquiry, I receive exactly what you type: your name, your email address, the subject if you fill one in, and your message. It is emailed to me and stored so I can reply and keep a record of the conversation.
Three more fields are optional: whether you are enquiring as an individual, for an organisation, as a recruiter or as an agency; the name of your organisation; and the topic. They are stored exactly as you choose them and are never checked against anything.
Alongside it I store your browser's user-agent string and a keyed one-way hash of your IP address, made with a secret key that exists only on the server. The hash exists only so a repeat spammer can be recognised. Your actual IP address is not written down anywhere I control, and without that key the hash cannot be turned back into it.
The form works the same whether or not you allowed visit insights.
What I collect when you just read the site
The site counts pageviews with its own analytics, built into the site rather than bought from anyone. For each page you open it records the path, the site's own ID for that page, the domain name of the site that linked you here (not the full address), short campaign codes if the link carried any, and a general description of your device, browser and operating system.
On the first page you open it also records how you arrived, as one word from a fixed list: direct, search, AI assistant, social, developer community, email, campaign or referral. Every later page in the same visit is recorded as internal. The address you came from is never sent.
It records an approximate location: your country, your state or region, and your time zone. These are worked out by the hosting provider from your IP address, so they describe where your internet connection appears to be, which can be wrong (a VPN or a mobile network can place you in another region). Your city is not recorded in these statistics.
It also records a visitor identifier, and this is the part worth being precise about: it is a keyed hash of today's date, your IP address and your browser string, made with a secret key that exists only on the server. The IP itself is never stored. Because the date is part of it, the identifier changes every day at midnight UTC, so today's visits cannot be joined to yesterday's. It is a counter, not a profile.
Some of these numbers are published openly on the /stats page. Nothing there identifies anyone.
Visit insights — only if you say yes
When you first open the site, a small card asks whether I may understand why you visited. You can ignore it and keep reading; the site works the same either way. Nothing described in this section happens unless you press “Allow selected”. You choose each part separately:
- Pages and buttons. For 15 days from your first page view, the site records which of its own pages you open — as a fixed ID such as “case study — AI-PULSE”, never a URL — which of its buttons you use (for example “contact”, “email”, “GitHub profile”), how you arrived as a category (“search engine”, “AI assistant”, “social”, “direct” and similar, never the address you came from), and, if you use the Cmd-K menu, only the broad topic of what you typed (“development”, “hiring”, “collaboration” or “other”), never the words.
- Link to an enquiry. Only if you also tick the box on the contact form, the pages you viewed in that browser session are attached to your enquiry, so I can see what you read. Nothing else is attached.
- Organisation lookup. The site asks the public internet registry responsible for your network who that network is registered to — usually an internet provider, a mobile carrier, a university or a company. It sends the registry the network block only (for example 49.36.0.0/24), never your full address, and your address is not stored. The answer describes the network, not you: being on a company's network does not mean you work there, and I never treat it as if it did.
What visit insights are used for, and what they are not
From those records the site forms a small number of written hypotheses — for example “possible interest in development work” — each shown to me with the exact pages and buttons behind it, the other explanations that fit just as well, and what remains unknown. None of them is a score or a probability, and none of them ever triggers a message to you.
- Never collected: gender, age, or any other personal or sensitive trait. There is no field for them and the system rejects them.
- Never done: device fingerprinting, tracking you on other sites, reconstructing your search history, buying contact details, or trying to work out who you are from your connection.
- Never sent: the text you type into any field you have not submitted, keystrokes, or the full address of any page.
Why I collect any of it
- To read and reply to your enquiry, and to keep a record of what was agreed.
- To know which pages people actually read, so the site can be improved.
- If you allow it, to understand why people visit — which work they look at and what brings them here.
- To stop the contact form and the site's own endpoints being abused by bots.
- Nothing is used for advertising, sold, rented, or shared for anyone else's marketing. Ever.
Who else touches it
That is the complete list. There is no analytics vendor, no CRM, no advertising network and no data broker in the chain.
- Vercel — hosts the site and serves the pages. Like every web host it keeps short-lived server request logs, which are outside my control.
- MongoDB Atlas — the database where enquiries, pageview counts and visit-insight records are stored.
- An SMTP email provider — delivers your enquiry to my inbox. It handles the message in transit.
- Only if you allow organisation lookup: IANA, which publishes the directory of registries, and the one regional internet registry responsible for your network (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC). The registry receives the network block described above, from this site's server, not from your browser.
- Google Fonts files are self-hosted on this domain, so your browser does not contact Google to load them.
How long it is kept
Enquiries are deleted automatically 24 months after you send them. That is enforced by the database, not by me remembering.
Pageview records are deleted automatically after 180 days, also enforced by the database.
Visit-insight records — pages, buttons, the link to an enquiry, the organisation lookup and the hypotheses — are deleted 22 days after your first page view at the latest: the 15-day window plus a 7-day period for late records. A bare record of the window's start and end dates is removed within one further day, so the daily clean-up can log the deletion. The answer a registry gave about a network is cached for 30 days so the same network is not looked up twice; it contains nothing about you.
A record that you agreed, and to what, is kept for 90 days. When visit-insight data is erased, a one-way marker is kept for 90 days so it cannot reappear from a backup; it cannot be traced back to you. Rejected requests to the site's endpoints are logged as an error code only, with no address and no content, for 7 days. Daily totals of how often the card was shown, accepted or declined are kept for 180 days.
If you want your enquiry deleted sooner, ask and it is gone.
Your rights
Under India's Digital Personal Data Protection Act 2023, and under the GDPR if you are in the EU or UK, you can ask me to:
- Tell you what data of yours I hold.
- Correct anything that is wrong.
- Delete it.
- Stop using it, and withdraw any consent you previously gave.
- Send you a copy of it.
- Complain to a regulator if you are not satisfied with how I handled your request.
Withdrawing visit insights
Use “Privacy choices” at the bottom of any page and press “Withdraw and erase”. Everything recorded about that visit is deleted at once — pages, buttons, any link to an enquiry, the organisation lookup and every hypothesis — the cookies are removed, and anything still in flight from your browser is refused. Your enquiry itself is not deleted by this; ask me if you want that too.
How to ask
Email contact@shivambhadoriya.com with what you want. There is no form to fill in and no account to create. I will reply within 30 days, and usually within 24 hours, because it is one person reading it.
I may ask you to confirm the email address the enquiry came from, so I do not hand your data to somebody else claiming to be you.
Children
This site is a professional portfolio and is not directed at children. I do not knowingly collect data from anyone under 18. If you believe a child has sent an enquiry, tell me and I will delete it.
Changes to this policy
If what the site does changes, this page changes with it and the date at the top moves. There is no version history to hunt through — what is on this page is what the site currently does.
Questions about this page: contact [at] shivambhadoriya dot com, or use the contact form.