Privacy
Policy.

This website, www.suboth.com (the “Site”), is the personal portfolio and blog of Suboth Ragunathan, a Full-Stack Cross-Platform Software & AI Engineer based in Sri Lanka. For the EU GDPR, the UK GDPR and Sri Lanka’s Personal Data Protection Act No. 9 of 2022 (PDPA), I am the data controller for personal data processed through the Site.

Contact: [email protected]

This policy covers the public Site (the portfolio, project case studies, the blog and its RSS feed) and explains what is collected, why, how long it is kept, who processes it and what rights you have. The Site also has a private admin area used only by me to publish content; it is not open to visitors. Websites linked from the Site (client projects, GitHub, LinkedIn, AI assistants and others) have their own policies.

Visitors don’t create accounts or fill in forms. The Site collects only the following:

• First-party analytics (cookieless). For each page you view: the page address, the website that referred you (domain only), any campaign tags in the link you followed (utm_source, utm_medium and similar), your approximate location (country and city, looked up by the hosting provider from your IP address at the moment of the request), device type, browser and operating system (read from your browser’s user-agent string), how long the page was visible, and the time.
• Daily visitor code. To count unique visitors without cookies, the server combines your IP address, user-agent, the date and a secret value into a one-way SHA-256 code. The code changes every day, can’t be reversed into your IP address, and can’t link your visits across days. Your IP address itself is not stored.
• Link clicks (goals). When you click the Hire Me button, an email link, the CV download or a link to another website, the Site records which kind of link it was, the destination’s domain for external links (for example github.com, never the full address), the page you were on, your approximate country, your device type and the same session and daily visitor codes. Other clicks, and anything you type, are never recorded.
• Consent-based analytics. Only if you click Accept, Google Analytics and Microsoft Clarity record usage, including clicks, scrolling and session recordings for Clarity. Details are in the next two sections.
• Your consent choice, stored in your own browser so the banner doesn’t reappear.
• Messages you send me. If you email me, I receive your address and whatever you write, and use it only to reply and, if we work together, to run the engagement.
• Technical logs. Cloudflare (DNS, security and CDN), Vercel (hosting), Cloudinary (images) and Google Firebase (content database) process IP addresses briefly to deliver and protect the Site, as any website must.

The first-party analytics doesn’t run in development builds, ignores known bots and crawlers, and is turned off in the browsers I use myself so my own visits don’t skew the numbers.

No cookies are set unless you accept the consent banner, which appears once you start using the page (or after a few seconds). Declining or ignoring it means no analytics cookies at all. The Site’s own analytics never uses cookies or browser storage.

To withdraw consent, clear this Site’s cookies and site data in your browser. The banner will appear again and nothing is set unless you accept.

• Site analytics (first-party): runs on the Site’s own server and is stored in Google Cloud Firestore under my Firebase project. Only I can read it. It shows totals and trends such as visitors, visits, popular, entry and exit pages, traffic sources and campaigns, countries and cities, devices, busiest times and link-click goals, which I can filter and export for my own use. These reports are never shared or sold.
• Google Analytics 4: loads only after you accept. GA4 does not log or store individual IP addresses.
• Microsoft Clarity: loads only after you accept. Heatmaps and session recordings show how pages are used. Analytics storage is enabled with consent; advertising storage is disabled.
• Vercel Analytics & Speed Insights: cookieless, aggregate page-view and performance metrics with no cross-site tracking.
• Cloudflare Web Analytics: cookieless, aggregate traffic metrics added automatically at Cloudflare’s network edge; no cookies, fingerprinting or persistent identifiers.

None of this is used for advertising, profiling or automated decision-making, and no personal data is sold, rented or shared for marketing.

Blog articles and case studies are read-only: there are no comments, newsletters or sign-ups. Images are served from Cloudinary’s CDN. The “Share” links on articles (X, LinkedIn, email) are ordinary links. No third-party share widgets or tracking pixels load until you click one, and then that service’s own policy applies.

The RSS feed at /blog/rss.xml contains only published articles; feed readers fetch it like any other page.

The footer has “Ask me on” buttons for ChatGPT, Claude, Gemini and Perplexity. They are plain outbound links: nothing is sent to any AI provider while you browse.

When you click one, a new tab opens on that provider’s site with a prefilled prompt about my professional background. The link carries only that prompt text, with no data about you, no identifiers and no tracking parameters. From then on you are on a third-party service governed by its own policy: OpenAI, Anthropic, Google and Perplexity. I receive no data back from them.

The Site publishes machine-readable summaries at /llms.txt and allows AI crawlers in robots.txt so assistants can describe my work accurately. These files contain only my own published professional information. Visitor data is never included, never shared with AI crawlers and never used to train models.

• Consent (Art. 6(1)(a)): Google Analytics and Microsoft Clarity. Withdraw any time as described above.
• Legitimate interests (Art. 6(1)(f)): the cookieless first-party analytics (including link-click goals), the cookieless Vercel and Cloudflare metrics, security and abuse prevention. The interest is understanding which content is useful and keeping the Site safe; it is balanced against your rights by storing no IP addresses, rotating the visitor code daily, honouring GPC/DNT and deleting records after 13 months.
• Steps before a contract (Art. 6(1)(b)): when you contact me about hiring or freelance work.

These providers process data for the Site under their own published terms:

These providers run global infrastructure, so data may be processed outside your country, including in the United States. Where GDPR applies, transfers rely on recognised safeguards such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses, as set out in each provider’s privacy documentation.

• First-party analytics: each page-view and link-click record, including its daily visitor code, is deleted automatically 13 months after the visit. Totals, charts and exports are calculated from these records, so nothing outlives them.
• Google Analytics: event-level data is kept for 14 months, then deleted automatically.
• Microsoft Clarity: recordings are kept for 30 days; favourites and a random sample may be kept for up to 9 months, per Microsoft’s documentation.
• Vercel and Cloudflare metrics: aggregate only, no personal records.
• Email: kept only as long as needed for your enquiry and any resulting work.

Depending on where you live, you have some or all of these rights:

• GDPR / UK GDPR: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to your supervisory authority.
• California (CCPA / CPRA): to know, correct and delete personal information, and to opt out of its sale or sharing. This Site does not sell or share personal information, and you will never be treated differently for using these rights.
• Sri Lanka (PDPA): access, rectification, erasure and withdrawal of consent under the Personal Data Protection Act No. 9 of 2022.

Email [email protected] and I will respond within 30 days. To be transparent: the first-party analytics stores no name, email or IP address, and its visitor code changes daily, so I usually cannot tell which records are yours (GDPR Art. 11). The simplest way to opt out of it entirely is to enable Global Privacy Control or Do Not Track in your browser.

The Site is a professional portfolio and is not directed at children under 16. It does not knowingly collect their personal data. If you believe a child has sent me personal data, contact me and it will be deleted.

The Site is served only over HTTPS with a strict Content Security Policy, frame-embedding protection and hardened headers. Database security rules let the public read only published content; analytics records can be read only by my admin account, and that account is protected by Firebase Authentication. API keys and secrets stay on the server. Collecting as little as possible remains the main safeguard.

If your browser sends a Global Privacy Control or Do Not Track signal, the Site’s own analytics does not record your visit at all. Cookie-based analytics is opt-in regardless: nothing is set unless you accept.

I update this policy whenever the Site’s data practices or the law change. The date at the top always shows the current version, and every change is listed in the version history below. The Site has no mailing list, so changes are announced on this page.

Questions, concerns or rights requests go to Suboth Ragunathan, Sri Lanka, at [email protected].