Privacy policy

Your analytics choice

Optional analytics starts only after you choose “Allow analytics.” Declining leaves the portfolio, résumé and contact links available. You can change your choice through “Privacy choices” in the footer. Global Privacy Control and Do Not Track override an allow choice.

Your preference is remembered in this browser for six months. If browser storage is unavailable, the choice lasts only for the current page. Allowing analytics does not subscribe you to messages or give consent to marketing.

Information used for optional analytics

• A page-view or résumé-link-click event, its time and the public page path. Query strings and page fragments are excluded.
• A broad source category, such as LinkedIn, Google, another website or direct/unavailable. The analytics database does not store the referring URL or hostname.
• A broad device category: desktop, mobile, tablet or unknown.
• A random ID for that single event, used to prevent duplicate processing. It is not a persistent visitor identifier.

City and country collection is disabled. A short-lived keyed value derived from an IP address may be used to limit abusive requests; the raw address is not stored in the analytics database, and these rate-limit records expire after roughly two minutes. No precise-location permission is requested. Analytics records do not store visitor names, email addresses, raw IP addresses, exact coordinates or a browsing history. Limited events should not be assumed to be perfectly anonymous.

Policy pages do not send optional analytics events. The portfolio’s own code uses no advertising pixels, session replay or fingerprinting. Video players load only after you choose Play; LinkedIn examples use local previews and links rather than embedded social feeds.

Videos and LinkedIn examples

Video previews are hosted locally and do not contact YouTube before you choose Play. That action loads a YouTube privacy-enhanced player and shares network information, such as your IP address and browser details, and this site’s origin with YouTube. YouTube may use cookies or other storage under its own policies. Privacy-enhanced mode does not mean that no data is processed.

Loading or watching a video is separate from allowing portfolio analytics. You can use the watch-on-YouTube link instead. LinkedIn previews are local; opening a post takes you to LinkedIn. These services apply their own practices after you activate a player or follow a link. Read the Google privacy policy and LinkedIn privacy policy.

Purpose and private Telegram reports

I use these events to understand which work is explored and whether the résumé link is useful. Event totals are available through my private Cloudflare database tools. No analytics dashboard or administrative API is exposed on the public website. A separate notification service is configured to send résumé-click alerts, a daily summary and limited website-health alerts to my private Telegram chat. Production scheduling and successful Telegram acceptance of résumé alerts and daily summaries were verified on October 15, 2026. Service or delivery failures can still cause gaps. The configured résumé-alert check runs about once a minute. Reports can contain the event time, page, broad source and device category; they do not contain a visitor name or contact details.

A click does not confirm a file was saved or read. Counts are not unique visitor counts. Declined consent, browser blockers, filtering and network failures leave gaps. Abuse controls limit collection to 120 event requests per minute and 2,000 per Toronto calendar day, and résumé alerts to 25 per day; reaching a limit can leave further gaps. I do not sell analytics records or use them for advertising.

Hosting and service providers

This website is hosted in my own Cloudflare account. The public website and a separate private notification service run as Cloudflare Workers. Delivering and securing a website involves network information such as IP addresses, browser headers and operational logs. Cloudflare may use its own security cookies or similar storage. The public portfolio does not offer visitor sign-in. These operations are separate from optional portfolio analytics.

Telegram processes copies of any delivered reports in its cloud messaging service. These bot messages are not end-to-end encrypted. Hosting, email and Telegram processing may take place outside Canada, where different laws and lawful-access rules can apply. I have not established Canadian-only storage or a fixed retention period for provider operational logs.

Provider information: Cloudflare privacy policy and Telegram privacy policy. The site’s browser-storage choices are explained in the cookie and storage policy.

Retention and withdrawal

Application analytics and notification-delivery records are configured for a 30-day retention window. The public collector deletes expired analytics and security counters when it processes accepted collection traffic. A separate scheduled service performs retention cleanup; its execution and daily cleanup records were observed on October 15, 2026. Without collection traffic or a working schedule, deletion can be delayed beyond 30 days; this also affects private notification-delivery records. Limited security counters record a fixed event category and hour, without request payloads, raw IP addresses or authentication values. They use the same retention limit. Cloudflare database recovery history may retain older copies for a limited provider-defined recovery window. Service outages can delay cleanup. Telegram message copies remain in my chat until deleted; they are not automatically removed when database records expire.

Choosing “Decline analytics” stops future optional events from that browser. An event already in transit may complete. Withdrawing consent does not automatically remove previously sent events or Telegram copies. Preferences on other browsers and devices are separate.

Contacting me and external links

Contact links open your email app or LinkedIn. There is no contact form, newsletter signup, visitor account registration or checkout on this portfolio. If you email me, I receive the address, message and attachments you choose to send and use them to respond and manage that conversation. Share only what is needed; avoid sending sensitive documents in an initial enquiry.

Correspondence may be retained while the conversation or a related professional relationship is relevant, or where needed for legal or record-keeping reasons. You may ask about deletion. LinkedIn, email services and other destinations apply their own practices after you leave this site.

Questions, access and correction

You can contact efedemirkaya06@gmail.com to ask about information relating to you, request correction or deletion, withdraw consent, or raise a concern. I will assess requests under the law that applies. Because analytics has no persistent visitor identifier, I may not be able to reliably locate an individual’s events. I may need proportionate information to verify a request; please do not send identity documents unless a specific need has been explained.

Access to stored reports is restricted to my Cloudflare account and the private notification service. This service accepts no incoming bot commands and holds no ChatGPT credentials. These safeguards reduce risk but do not make any service risk-free. Material changes to purposes, recipients or collection will be reflected here and, where required, in renewed consent.