Privacy

This is a personal portfolio, not a company with a data department. It collects about as little as a site can while still telling me whether anyone reads it. Here is exactly what that means, in plain language instead of the usual wall of clauses.

Last updated: 4 September 2026.

Who is responsible

Me, Ariful Islam, working from Dhaka, Bangladesh. Questions, requests, and complaints go to [email protected], and I answer them myself.

What this site does not do

There is no contact form, no newsletter, no account to create, and no comment section, so nothing here asks you for your name. There is no advertising, and nothing is sold or handed to advertisers or data brokers. Fonts load from this site's own domain rather than from Google Fonts, so opening a page does not announce your visit to a third party.

Analytics

I use Google Analytics 4 to see which pages people actually read.

Outside the European Economic Area, the United Kingdom, and Switzerland, it stores one first-party cookie so that a second visit is not counted as a second stranger. Inside those countries it stores nothing at all: no cookie, no identifier, nothing written to your device. That is why no cookie banner has interrupted you. The trade is real and I made it deliberately, since European visits end up counted less precisely, and I would rather accept that than put a consent dialog between you and the page.

Either way, what Analytics receives is the page you opened, the page that sent you, a rough location worked out from your IP address (Google drops the address and keeps a country and region), and your browser, device, and language. It never receives your name or email, because this site never has them. Google is my processor for this and its own controller for parts of it; their terms live at policies.google.com/privacy. The data is kept for up to 14 months and then deleted.

The legal basis is your consent where a cookie is set, and legitimate interest in knowing whether the work reaches anyone where no cookie is set.

Hosting and security

Cloudflare sits in front of this site as a CDN, so every request arrives there before it reaches my server. Cloudflare processes your IP address and request headers to serve pages from somewhere near you and to absorb attacks. That is a legitimate interest in keeping the site standing, and it is also unavoidable: no server can send a page back without knowing the address to send it to.

The site itself is a static build running in a container on a server I rent. Its logs keep request lines, including IP addresses, briefly, for the same operational reason.

Things you can click that involve somebody else

• Booking a call opens Google Calendar's scheduling page inside a dialog. From the moment it opens you are on Google's page, under Google's terms.
• The project demos embed each running app from wherever it is hosted. Those frames get no clipboard access and no referrer, so the embedded app is not told which page of mine you came from, though it does see that somebody arrived.
• The links to Fiverr, Upwork, GitHub, and LinkedIn are ordinary links. Nothing loads from any of them until you follow one.

What ends up on your device

Two things, both first party, neither used to follow you anywhere:

• Your light or dark theme choice, kept in your browser's local storage so the next page does not flash the wrong theme at you.
• The Analytics cookie described above, outside Europe, the UK, and Switzerland.

Search deserves a mention of its own. The search index is downloaded to your browser and every query runs there, so what you type into the search box never leaves your machine and I have no way to see it.

Your rights, and how to actually use them

In the EEA or the UK you have the right to see your data, correct it, have it erased, object to processing based on legitimate interest, and complain to your data protection authority. Anywhere else, ask anyway: I will treat the request the same way.

The honest caveat is that an ordinary visit leaves me holding nothing that identifies you, so there is usually nothing to hand over or delete. Where I can act is on anything you have sent me directly, such as an email thread or a booked call.

If you would rather stop Analytics before it happens than ask about it afterwards, any content blocker will do it, and so will Google's own opt-out extension at tools.google.com/dlpage/gaoptout. Google Analytics does not honour the Do Not Track header, and I would rather tell you that than let you assume otherwise.

Changes

If any of this changes, this page changes and the date at the top moves. There is no mailing list to announce it on, which is rather the point.