Switch to Chinese

Privacy Policy

Last updated: 2026-07-28

Cookies this site sets

This site has no user accounts and no login. Every visitor is anonymous. A small set of cookies exists only to make the AI chat widget and its abuse-prevention (rate limiting, bot detection) work:

  • anonId — a random identifier (not tied to your name, email, or any account), used to apply rate limits and daily quota to the chat widget. HttpOnly, 7 days.
  • client-ip / client-ua — your IP address and browser's user-agent string, read once per session and stored raw (not hashed) in these two HttpOnly cookies in your own browser — this site's server does not keep a separate hashed copy. When this information is written to a server log line, it is hashed first; the raw value is never written to a log file. HttpOnly, 7 days.
  • user-public-key-1 / user-public-key-2 — a one-time RSA public key used to encrypt your chat messages before they leave your browser. Not secret, not HttpOnly (your browser needs to read it to encrypt), expires after 30 minutes.

None of these cookies are used for advertising, cross-site tracking, or sold/shared with any third party. There is no analytics script and no ad network on this site. (See "What's stored in your browser" below for a device identifier that isn't analytics or advertising, but is a persistent identifier nonetheless — worth noting alongside the cookies above.)

What's stored in your browser (localStorage)

Beyond the cookies above, the AI chat widget stores two more things in your browser's localStorage. These aren't cookies — they aren't automatically sent with every request — but they currently have no expiration and remain in your browser until you clear them manually:

  • fingerprintId — a randomly generated device identifier sent along with every chat message to this site's own server, used only for this site's internal processing — never forwarded to Anthropic (see "What the AI chatbot sees" below). This isn't an advertising or analytics tracker, but it is a persistent, cross-session, device-level identifier — unlike the cookies above, which expire.
  • Your chat history (the conversation itself) is also stored in localStorage with no expiration. You can clear the visible conversation using the "Clear chat history" button in the chat widget — but that button does not clear fingerprintId; to remove that too, clear this site's data manually in your browser settings.

What the AI chatbot sees

Messages you send to the chat widget are encrypted in your browser and decrypted only on the server, then sent directly to Anthropic (Claude API) to generate a reply — no longer relayed through AWS. Your message content and language are sent directly; anonId, IP address, user-agent, and similar identifiers are used only for this site's own abuse-prevention checks (rate limiting, quota, bot detection) and are never included in the request sent to Anthropic.

This site keeps a short-term memory of recent conversation and uses it for follow-up replies: so the AI can remember what you asked earlier, the last few exchanges are cached in this site's own Redis store for a rolling 24-hour window measured from your last message — continued activity keeps extending that window, and the cache clears automatically once 24 hours pass with no new message; nothing is kept long-term.

The AI queries this site's own content through internal tools to answer questions: both content published on pages (blog posts, certification lists, profile summary, etc.) and additional background info about the site owner that isn't rendered on any page but is specifically curated for the AI to share (e.g. full work history, education, skills, English proficiency, and other career background) — none of this involves any visitor data. These tool calls run inside this site's own server and never access any visitor's personal data or other non-public content.

In certain situations, a conversation may be relayed live to the site owner himself, who can reply directly through Telegram: if the conversation shows a clear business-collaboration or job-opportunity intent and you agree to try, the AI forwards that conversation's content (not your IP address, user-agent, or similar identifiers) to the owner's Telegram, and he replies in person — his replies then appear in this site's chat widget. Whether he's actually able to join right away depends on whether he's available at that moment; it's never guaranteed.

If you choose to leave your contact info for the owner to follow up later, this site collects the name (or company name), contact method (e.g. email, LINE, Telegram), and description of what you want that you provide, and forwards it to the site owner, used only for that follow-up — never for any other purpose. Conversely, the AI will never proactively hand out the site owner's own contact info (such as his email) to you — contact info only ever flows one way, from you to the owner; even if you ask directly, the AI won't disclose it on his behalf (the contact info published on this privacy page itself is this page's own disclosure and isn't covered by that restriction).

Your name (or company name), contact method, and stated purpose mentioned during the conversation are stored in a structured form for up to 7 days, matching the lifetime of the anonId cookie that identifies you — this lets the AI remember what you've told it across multiple visits, and gives the site owner context for following up. This information is entirely self-reported by you, never independently verified, used only internally by this site — never for marketing, analytics, or any other purpose, and never shared with any third party.

Separately from what's sent to Anthropic above, when this interaction is written tothis site's own server logs, the IP address and user-agent are hashed first and the raw values are never written to a log file or disk. For debugging and operations, the message you sent and the AI's reply are currently written to server logs in plain text — these log files rotate automatically by size and older ones are deleted on a rolling basis (not kept indefinitely), and are used only by the site's operator for troubleshooting — never for any other purpose, and never shared with any third party.

Third-party services linked from this site

Blog posts link to two external services; the AI chatbot's replies sometimes include a link too (e.g. a third-party page verifying some background info), always opening in a new tab. Following any of these links takes you off this site entirely — this site never embeds them as an iframe or loads their script, and has no database or payment-processing logic of its own for any of them:

  • Cal.com (booking a meeting) — scheduling, timezone conversion, video-call link generation, and any reminder emails are handled entirely by Cal.com's own hosted service. Whatever information you enter on their booking page (name, email, meeting details) is processed under Cal.com's own privacy policy, not this site's.
  • Buy Me a Coffee (sponsoring) — any payment information you enter is processed entirely by Buy Me a Coffee's own hosted service, under their privacy policy.
  • Links the AI provides in chat replies (e.g. a third-party page verifying some background info about the site owner) — handled entirely by that site, under its own privacy policy, not this site's.

Questions

This is a personal portfolio site with no dedicated privacy contact form. If you have a question about how it handles data, email me at yinxuanh@gmail.com.