Privacy, without the fog.
This is a personal portfolio run by Soham Kakra. I use a small, first-party analytics system only to understand how the site is found and used, and only after you explicitly accept it.
Who is responsible
Soham Kakra is the data controller for this website. For privacy questions, access requests, deletion requests or withdrawal of consent, email sohamkakra@gmail.com.
What is stored on your device
Before you choose, no analytics identifier or attribution data is stored. Your choice is saved in local storage as sk-measure for up to six months so the site does not repeatedly ask. This preference is necessary to respect your decision.
If you accept analytics, a random session identifier and first-touch UTM labels are stored in session storage. They disappear when the browser session ends. Public visitors receive no advertising, marketing or cross-site cookies.
The site does not install an offline service worker or create its own content caches. Your browser may still use its standard HTTP cache to load ordinary website files efficiently.
The admin_session cookie is strictly necessary only for Soham's private administration area. It is HTTP-only, secure in production, same-site strict, and expires after 30 days. It is not issued to ordinary visitors.
What analytics collects
After consent, the site records page paths, visible time, scroll progress, chapters reached, clicks, opened photographs, interaction problems, performance metrics, device category, viewport size, theme, reduced-motion preference, time zone, country supplied by the hosting edge, referring hostname, and the allow-listed UTM fields source, medium and campaign.
It does not record form contents, keystrokes, full referring URLs, search terms, names, email addresses, advertising identifiers or activity on other websites.
This site does not build marketing profiles or make automated decisions about visitors.
Purpose and legal basis
The purpose is audience measurement, SEO evaluation, performance monitoring and improving this site's UX/UI. The legal basis for analytics is your consent under Article 6(1)(a) GDPR and the Dutch rules implementing the ePrivacy Directive. Analytics remains off unless you actively accept.
You may refuse without losing any feature. You may withdraw consent at any time using the “anonymous analytics” control in the footer. Withdrawal stops future collection and has no negative consequence.
Hosting, delivering the pages and protecting the site from abuse require limited technical processing. That processing is based on the legitimate interest in operating a secure website under Article 6(1)(f) GDPR.
Identifiers, security and retention
The server receives an IP address and user-agent as part of the normal web request. For analytics, the IP is masked before it is combined with the user-agent, a secret salt and the current day. The resulting one-way value is used only for approximate daily unique counts and rate limiting. It rotates daily and the raw IP is not written to the analytics database.
Detailed session records expire after 45 days. Daily aggregate counts expire after 24 months. Data is transmitted over HTTPS and the analytics dashboard is restricted to the site administrator.
Service providers and transfers
Vercel hosts and delivers the website. Upstash provides the Redis database used for consented analytics. They process data under their service terms and the data-processing agreement applicable to the account. Processing may involve the United States or other locations outside the EEA; their published safeguards include the EU Data Privacy Framework and/or Standard Contractual Clauses where applicable.
Vercel also states that it collects end-user IP addresses, IP-derived city and country, and system configuration information as service-generated hosting data. It retains that information only while needed for the purposes described in its own privacy notice, legal obligations and security.
Your rights
Where GDPR applies, you may request access, correction, deletion, restriction, portability, or object to processing, and you may withdraw consent at any time. Because the analytics system does not ask who you are, I may need the session identifier and approximate visit time to locate a record.
You may also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.