# Privacy Policy — rowan-kendal.com

Last updated: 2 September 2026

## Who is responsible

This site is the personal portfolio of Rowan Kendal, an individual based in
Israel, who is the data controller for any personal data processed through
it. Contact: rowan.kendal@gmail.com. The policy is written to meet the EU and UK GDPR. The
site collects as little as it can, sells nothing, and uses no advertising or
cross-site tracking.

## What is processed, and why

| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting any page | IP address, user agent, requested URL (transient) | Serving the site, security, rate limiting | Legitimate interest, Art. 6(1)(f) | Rate-limit counters in memory for at most 10 minutes; hosting logs per Vercel's retention |
| Vercel Web Analytics | Page URL, referrer, country, device type; daily-rotating hash, no identifier | Aggregate visit counts | Legitimate interest; "Decline" is honoured as an objection | Aggregated, no per-visitor record |
| PostHog analytics (only after Accept) | Page views, page leave, referrer, browser and screen info, random device ID | Understanding which pages are useful | Consent, Art. 6(1)(a), withdrawable any time | Until consent is withdrawn or site data cleared; PostHog retains events per its policy |
| Pipeline Defense leaderboard | Name typed (max 50 chars), score, level, date | Public high-score table, also served by the API and MCP server | Consent; submitting is optional | Top 100 entries until removed on request |

## Analytics and your choice

PostHog is loaded only after clicking "Accept" on the banner; until then no
PostHog script runs and nothing is stored for it. It is configured for
page-level analytics only: no click autocapture, session replay, heatmaps or
surveys, the client IP is not stored on events, and Do Not Track is
honoured. PostHog may process data in the United States under standard
contractual clauses (https://posthog.com/privacy).

Vercel Web Analytics runs without cookies or a stored identifier and only
produces aggregate counts; clicking "Decline" drops its events as well
(https://vercel.com/docs/analytics/privacy-policy).

The choice can be changed or withdrawn at any time via the "Cookie settings"
control in the footer of every page. Withdrawing stops PostHog immediately
and deletes the identifiers it stored in the browser; it does not affect
processing that happened before.

## Cookies and local storage

| Key | Type | Set when | Purpose |
|---|---|---|---|
| cookie-consent | localStorage | Accept or Decline clicked | Remembers the analytics choice ("accepted" or "declined") |
| cookie-consent-date | localStorage | Accept or Decline clicked | When the choice was made |
| ph_*_posthog | cookie + localStorage | Only after Accept | PostHog device ID and session; removed on Decline |
| pd_scores | localStorage | A Pipeline Defense score is saved | Local copy of recent scores |

The consent entries are strictly necessary to remember the choice and are
not used for tracking. No advertising or social-media cookies are set.

## Who receives data (processors)

- Vercel Inc. (US): hosting, edge network, Web Analytics.
- PostHog Inc. (US): product analytics, only with consent.
- Upstash: Redis database holding the public leaderboard.
- Google (Gmail): the mailbox where direct contact emails land.

Transfers outside the EU/UK rely on the EU-US Data Privacy Framework or
standard contractual clauses; Israel holds an EU adequacy decision.

## Contacting Rowan directly

Email, phone and LinkedIn links open your own apps; nothing is submitted
through this site. Messages are used only to reply and kept as long as the
conversation is relevant.

## Your rights

Under the GDPR you can ask to access and receive a copy of your data, have
it corrected or erased (for example a leaderboard name), restrict or object to processing based on legitimate interest,
and withdraw consent at any time. Send requests to rowan.kendal@gmail.com; they are
answered within one month. Complaints can be made to any EU supervisory
authority (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) or
the UK ICO.

## Security, children, and changes

All traffic is served over HTTPS with a strict Content Security Policy and
rate-limited APIs. The site is not directed at children under 16. Changes
are published at https://www.rowan-kendal.com/privacy with a new date; this Markdown copy is
kept in sync.