Privacy policy

This site is the portfolio of Kaveen De Alwis, a freelance software engineer based in Colombo, Sri Lanka. I'm the data controller for the personal data described here. For anything about your data, email mailme@kaveenhyacinth.com.

I collect as little as I can, I don't sell personal data, I don't run ads, and I don't make automated decisions about you.

What I collect and why

Analytics, only if you accept

If you click Accept on the cookie banner, the site loads Google Tag Manager and Google Analytics 4 (provided by Google). They record which pages you view and which links and buttons you use (for example "Book a call"), plus your browser, device type and approximate location (derived from your IP address).

• Legal basis: your consent (GDPR Art. 6(1)(a)).
• Retention: Google Analytics deletes event-level data after 2 months and user-level data 14 months after your last visit.
• If you click Reject, or don't choose, none of this loads and nothing is sent to Google. You can change your answer at any time with Cookie settings in the footer. Rejecting after accepting also deletes the Analytics cookies.

Advertising signals are always switched off: this data isn't used for ads.

Booking a call

The Book a call button opens a booking page run by Proton AG (Proton Calendar) in Switzerland. When you book, you give your name, email address, the time you picked and anything you write in the booking form. Calls take place on Proton Meet.

• Legal basis: taking steps at your request before we may enter into a contract (GDPR Art. 6(1)(b)).
• Retention: as long as we're in touch about the work. If we don't work together, I delete your details once they're no longer needed for that conversation. If we do, project records are kept as long as the contract and tax law require.

Email

If you email me, your message and address are stored in my mailbox, hosted by Apple (iCloud Mail).

• Legal basis: my legitimate interest in replying to you (GDPR Art. 6(1)(f)), or steps before a contract if you're asking about a project.
• Retention: same as bookings.

Hosting

The site is hosted by Vercel Inc. Like any web server, it processes your IP address, browser details and the pages requested, to deliver the site and protect it from abuse. These logs are kept according to Vercel's log retention.

• Legal basis: my legitimate interest in running a secure, working website (GDPR Art. 6(1)(f)).

Cookies and browser storage

Analytics cookies are only set after you accept:

• _ga and _ga_<id>: Google Analytics, to tell visits apart. They're deleted if you reject later.

These are stored in your browser and never sent anywhere:

• kh_consent_v1 (local storage): your cookie choice, so the banner doesn't ask on every page. It's kept for 12 months, then you're asked again.
• kh_intro_v1 and kh_story_prompt_v1 (session storage): whether you've seen the intro and the story mode prompt during this visit. They're cleared when you close the tab.

Who else processes your data

• Google (Analytics, Tag Manager), only with your consent
• Proton AG, Switzerland (booking page, video calls)
• Apple (iCloud Mail)
• Vercel Inc., USA (hosting)

Links to LinkedIn, GitHub and Substack take you to their sites, where their own privacy policies apply.

International transfers

I work from Sri Lanka, so what you send me by booking or email is handled there. Proton is in Switzerland. Google, Apple and Vercel may process data outside the EU and UK, including in the USA, under their own data processing terms.

Your rights

Under the GDPR and UK GDPR you can ask me to:

• give you a copy of the personal data I hold about you
• correct it
• delete it
• restrict or object to how I use it
• send it to you or another service in a portable format

You can also withdraw consent at any time (for analytics, use Cookie settings in the footer). Email mailme@kaveenhyacinth.com and I'll reply within one month.

If you're unhappy with how I've handled your data, you can complain to the data protection authority where you live, for example the ICO in the UK or your national authority in the EU. I'd appreciate the chance to put it right first.

Changes

If what this site collects, who processes it or how long it's kept changes, I'll update this page and the date at the top.