What this site knows about you.

Reading the site

Reading a page contacts two addresses: hanyzuhudi.com, and Google, for the analytics tag described below. Until you agree, that tag runs without cookies, so no cookie is set by anyone. The typefaces are served from here rather than fetched from Google.

There is no advertising on this site, no remarketing tag, and nothing that follows you to other sites.

• One entry is kept in your browser, hz:seen, which remembers that you have already watched the opening animation. It lives in session storage, so closing the tab clears it, and it never leaves your device.
• A second entry records your answer about analytics, so you are not asked again on every visit. It stays on your device too.
• Vercel, which hosts the site, records aggregate page views and loading speed. It is served from this domain, sets no cookies, and builds no profile of you across other sites.
• Vercel also keeps ordinary server logs, which include IP addresses, for a short period. That is how any web server works.

The choice about analytics

I use Google Analytics to see which pages get read and where readers arrive from. It is genuinely useful for deciding what to write next, and it is genuinely more invasive than everything else on this page, so it is off until you turn it on.

Before you choose, the tag is on the page in its cookieless mode. Google receives that a page here was viewed, the page that referred you, your device type and an approximate location from your IP address, and nothing that identifies you or connects one visit to the next. If you ignore the question, it stays that way. If you decline, the tag is switched off before it runs and sends nothing at all.

If you agree, Google Analytics sets cookies in your browser and sends Google your page views, the page that referred you, your device type, and an approximate location derived from your IP address. Google processes that under its own terms, which I do not control.

One detail worth naming rather than leaving you to find it: the tag also contacts google.com itself, not only the analytics domain. That request is how Google can connect a visit to a signed-in Google account. It is part of what agreeing here allows, and declining prevents all of it.

You can change your mind here at any time. Turning it back off deletes the cookies Google set, switches the tag off before it can send anything further, and reloads the page so the script itself is gone rather than merely idle. Clearing your browser data clears the choice with it.

Writing to me

The contact form asks for a name, an address to reply to, what the message is about, and the message. All four are stored in a database so that nothing is lost if email fails, and a copy is sent to my inbox.

That is the whole purpose: to read your message and reply to it. It is not a mailing list, and you will not be added to one.

• Your IP address is not stored. A salted one-way hash of it is, which is enough to notice one source sending many messages in an hour and not enough to recover the address.
• Messages are kept until I delete them. There is no automated schedule, and there is no analytics on what you write.
• Nothing you send is sold, shared, or handed to anyone for marketing.

The template downloads

The sheets on the workspace page are plain files. There is no form in front of them, no address to leave, and no record of who took one.

Who else is involved

Four companies touch this website in the ordinary course of running it. Each is used for one job and nothing more.

• Vercel hosts the site and reports aggregate traffic.
• Neon stores the messages the contact form receives.
• Zoho carries the notification email to my inbox. If email is ever routed through another provider, this page will say so.
• Google receives anonymous page counts from every reader, and the fuller analytics described above only from readers who agreed.

Connecting my own social accounts

I schedule my own posts to LinkedIn and other social platforms through Postiz, which connects to those accounts using the platforms' official APIs. That is the only reason this site holds a developer account with any of them.

This is about my accounts, not yours. Reading this site sends nothing to any social platform, and there is no share button, embedded feed, or platform script anywhere on it.

• Postiz runs on my own infrastructure rather than as a hosted service, so the access tokens stay with me. No other company holds them at any point.
• This website never receives those tokens, never stores them, and has no code that touches them. The scheduling runs separately from the site.
• I do not collect, store, or process data about any other person through those APIs. No follower lists, no profiles, no messages, no audience exports.
• Anything read back from a platform is limited to my own posts and their public engagement counts, used to see how my own writing traveled.
• I can revoke the connection from the platform itself at any time, which ends the access immediately.

Who is responsible

This site is run by Hany Zuhudi, working from Nairobi, Kenya. There is no company behind it and no third party operating it on my behalf.

Anything on this page, and any request about data held about you, comes back to me directly through the contact page.

Asking me to change or delete something

Write to me and ask. I will tell you what is held, correct it, or delete it. You do not need to give a reason, and there is no form to fill in beyond the one on the contact page.

There is no privacy department to route it through, so the answer comes from me directly and usually quickly.

When this changes

If what the site collects changes, this page changes in the same commit. The date at the top is when it last did.