Switch to Chinese

Privacy Policy

Last updated: 2026-10-30

Cookies this site sets

This site has no user accounts and no login. Every visitor is anonymous. A small set of cookies exists only to make the AI chat widget and its abuse-prevention (rate limiting, bot detection) work:

  • anonId — a random identifier (not tied to your name, email, or any account), used to apply rate limits and daily quota to the chat widget; the server also uses it to match your conversation memory, the contact details you provide, and temporary handoff state to the same visitor. HttpOnly, 7 days.
  • client-ua — your browser's user-agent string, read once per session and stored raw (not hashed) in this HttpOnly cookie in your own browser — this site's server does not keep a separate hashed copy. When this information is written to a server log line, it is hashed first; the raw value is never written to a log file. HttpOnly, 7 days.
  • user-public-key-1 / user-public-key-2 — a one-time RSA public key used to encrypt your chat messages before they leave your browser. Not secret, not HttpOnly (your browser needs to read it to encrypt), expires after 30 minutes.

None of these cookies are used for advertising, cross-site tracking, or sold/shared with any third party. There is no analytics script and no ad network on this site. (See "What's stored in your browser" below for a device identifier that isn't analytics or advertising, but is a persistent identifier nonetheless — worth noting alongside the cookies above.)

What's stored in your browser (localStorage)

Beyond the cookies above, the AI chat widget stores two more things in your browser's localStorage. These aren't cookies — they aren't automatically sent with every request — but they currently have no expiration and remain in your browser until you clear them manually:

  • fingerprintId — a randomly generated device identifier sent along with every chat message to this site's own server, used only for this site's internal processing — never forwarded to Anthropic (see "What the AI chatbot sees" below). This isn't an advertising or analytics tracker, but it is a persistent, cross-session, device-level identifier — unlike the cookies above, which expire.
  • Your chat history (the conversation itself) is also stored in localStorage with no expiration. You can clear the visible conversation using the "Clear chat history" button in the chat widget — but that button does not clear fingerprintId; to remove that too, clear this site's data manually in your browser settings.

What the AI chatbot sees

Messages you send to the chat widget are encrypted in your browser and decrypted only on the server, then sent directly to Anthropic (Claude API) to generate a reply — no longer relayed through AWS. Your message content and language are sent directly; anonId, IP address, user-agent, and similar identifiers are never included in the request sent to Anthropic: the IP address and user-agent are used only for this site's own abuse-prevention checks (rate limiting, quota, bot detection); anonId is additionally used, on this site's server, to match your conversation memory, contact details and handoff state (see below).

Anthropic's role and retention: Anthropic acts as a service provider (data processor) and processes the messages you send, on this site's instructions, to generate a reply. According to Anthropic's published retention information, inputs and outputs are generally deleted from its back end within 30 days; if a conversation is flagged by its trust and safety systems as a possible usage-policy violation, it may be kept for up to 2 years, and data may also be kept where the law requires. These are Anthropic's practices and may change with its policies — seeAnthropic's data retention article. Under Anthropic's commercial terms, Anthropic does not use content sent through its API to train its models; this site has not joined Anthropic's Development Partner Program (only joining it allows such use).

This site keeps a short-term memory of recent conversation and uses it for follow-up replies: so the AI can remember what you asked earlier, the last few exchanges are cached in this site's own Redis store for a rolling 24-hour window measured from your last message — continued activity keeps extending that window, and the cache clears automatically once 24 hours pass with no new message; nothing is kept long-term.

The AI queries this site's own content through internal tools to answer questions: both content published on pages (blog posts, certification lists, profile summary, etc.) and additional background info about the site owner that isn't rendered on any page but is specifically curated for the AI to share (e.g. full work history, education, skills, English proficiency, and other career background) — none of this involves any visitor data. These tool calls run inside this site's own server and never access any visitor's personal data or other non-public content.

In certain situations, a conversation may be relayed live to the site owner himself, who can reply directly through Telegram: if the conversation shows a clear business-collaboration or job-opportunity intent and you agree to try, the AI forwards that conversation's content (not your IP address or user-agent; on the handoff request the owner sees, you appear only as an irreversible hash code, never the raw anonId) to the owner's Telegram, and he replies in person — his replies then appear in this site's chat widget. Whether he's actually able to join right away depends on whether he's available at that moment; it's never guaranteed.

If you choose to leave your contact info for the owner to follow up later, this site collects the name (or company name), contact method (e.g. email, LINE, Telegram), and description of what you want that you provide, and forwards it to the site owner through Telegram, used only for that follow-up — never for any other purpose. Conversely, the AI will never proactively hand out the site owner's own contact info (such as his email) to you — contact info only ever flows one way, from you to the owner; even if you ask directly, the AI won't disclose it on his behalf (the contact info published on this privacy page itself is this page's own disclosure and isn't covered by that restriction).

Your name (or company name), contact method, and stated purpose mentioned during the conversation are stored in a structured form for up to 7 days, matching the lifetime of the anonId cookie that identifies you — this lets the AI remember what you've told it across multiple visits, and gives the site owner context for following up. This information is entirely self-reported by you, never independently verified, used only internally by this site — never for marketing, analytics, or any other purpose, and never shared with any third party except Telegram, which carries it to the site owner (see below).

Separately from what's sent to Anthropic above, when this interaction is written tothis site's own server logs (kept by Cloudflare Workers Logs), the IP address and user-agent are hashed first and the raw values are never written to a log. For debugging and operations, the message you sent and the AI's reply are currently written to server logs in plain text — more detailed debug content (such as the system prompt and the full content of the AI's tool-call steps) is off by default and only switched on temporarily while debugging. These logs are kept for up to 7 days and then deleted automatically, are used only by the site's operator for troubleshooting — never for any other purpose — and are not shared with any third party other than Cloudflare, which stores them.

Hosting and storage services this site uses: this site runs on Cloudflare Workers (the web server and the server logs above are hosted by Cloudflare); conversation memory, the contact details you provide, rate-limit counters, and temporary handoff state are stored in Upstash's Redis database and deleted automatically on the schedules described on this page. The contact details you leave and the live-handoff conversation are also sent to the site owner through Telegram and stored on Telegram's servers; how long Telegram keeps them is set by its own policy (see the Telegram privacy policy). All three process data under their own terms and privacy policies.

If the site's optional operations alerting (Slack) is switched on, a serious error sends a short alert there with only the error name, status code and irreversible hash codes — never the text of your messages.

Age and region: this site's AI chat is not designed for users under 18; please do not use it if you are under 18. The chat is provided through Anthropic's service, and Anthropic only offers its service in the countries and regions it supports (see itsSupported Regionspage); if you are in an unsupported region, please do not use this chat.

Third-party services linked from this site

Blog posts link to two external services; the AI chatbot's replies sometimes include a link too (e.g. a third-party page verifying some background info), always opening in a new tab. Following any of these links takes you off this site entirely — this site never embeds them as an iframe or loads their script, and has no database or payment-processing logic of its own for any of them:

  • Cal.com (booking a meeting) — scheduling, timezone conversion, video-call link generation, and any reminder emails are handled entirely by Cal.com's own hosted service. Whatever information you enter on their booking page (name, email, meeting details) is processed under Cal.com's own privacy policy, not this site's.
  • Buy Me a Coffee (sponsoring) — any payment information you enter is processed entirely by Buy Me a Coffee's own hosted service, under their privacy policy.
  • Links the AI provides in chat replies (e.g. a third-party page verifying some background info about the site owner) — handled entirely by that site, under its own privacy policy, not this site's.

Questions

This is a personal portfolio site with no dedicated privacy contact form. If you have a question about how it handles data, email me at yinxuanh@gmail.com.