Privacy
Grouped by what you did, rather than by what I could collect. Opening a page is the only row that applies to everyone — the other 3 need you to act first. I am the data controller: Cheng-Yuan King, Sheffield, United Kingdom, at rosscyking@gmail.com.
What is collected, and when
You open a page · always
The page you asked for, your IP address and your browser's user agent
Serving the page at all, and the host's own security and abuse logs
- Who receives it
- Vercel, as the host
- Kept for
- not stated yet
A page view and its Core Web Vitals — path, referrer, coarse device and country
Knowing which pages are read, and whether they load quickly
- Who receives it
- Vercel Web Analytics and Speed Insights, first-party and cookieless
- Kept for
- not stated yet
You switch between light and dark
One cookie, named theme, holding light, dark or system
So the site opens the way you left it, with no flash of the wrong theme
- Who receives it
- Nobody. It is first-party and is never sent anywhere
- Kept for
- Until you clear it
You send the contact form
Your name, email address, message, and company if you gave one
So I can read it and reply
- Who receives it
- Resend, which delivers the email, and then my inbox
- Kept for
- not stated yet
Your IP address
Rate limiting — five submissions an hour — and it is also printed in the notification email I receive
- Who receives it
- Upstash, which holds the rate-limit counter, and my inbox
- Kept for
- not stated yet
You complete the bot check
A Turnstile token and your IP address
Confirming the submission came from a person
- Who receives it
- Cloudflare
- Kept for
- Cloudflare's own retention — see their privacy policy
Not collected
Each of these was checked against the code that would have to do it, and against the live site on 2 August 2026 — not assumed.
- No account, no login, no password — there is nothing to sign into.
- No advertising, no cross-site tracking, and no data sold or shared for marketing.
- No analytics cookie. Loading the site sets no cookie at all; the only one it can ever set is the theme, and only if you use the toggle.
- No third-party fonts. The typefaces are served from this domain, so no font CDN sees your request.
- No newsletter and no mailing list. Sending the form subscribes you to nothing.
- No profiling and no automated decision-making.
Your rights
Under the UK GDPR you can, at any time:
- Ask what I hold about you, and get a copy of it.
- Have it corrected if it is wrong.
- Have it deleted.
- Object to it being held, or ask me to restrict what I do with it.
- Complain to the Information Commissioner's Office if you think I have got this wrong.
Email rosscyking@gmail.com and I will do it. The ICO's own guidance is at ico.org.uk.