Privacy Policy
Last updated: 2 September 2026
Who is responsible
This site is the personal portfolio of Rowan Kendal, an individual based in Israel, who is the data controller for any personal data processed through it. Contact: [email protected].
This policy is written to meet the EU and UK General Data Protection Regulation (GDPR). The site collects as little as it can, sells nothing, and uses no advertising or cross-site tracking.
What is processed, and why
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting any page | IP address, user agent, requested URL (transient) | Serving the site, security, rate limiting | Legitimate interest (Art. 6(1)(f)) | Rate-limit counters live in memory for at most 10 minutes; hosting logs per Vercel's retention |
| Vercel Web Analytics | Page URL, referrer, country, device type; a daily-rotating hash instead of an identifier | Aggregate visit counts | Legitimate interest (Art. 6(1)(f)); you can object with “Decline” | Aggregated; no per-visitor record |
| PostHog analytics (only after you accept) | Page views, page leave, referrer, browser and screen info, a random device ID | Understanding which pages are useful | Consent (Art. 6(1)(a)), withdrawable at any time | Until you withdraw consent or clear site data; PostHog retains events per its policy |
| Pipeline Defense leaderboard | The name you type (max 50 chars), score, level, date | Public high-score table, also served by the API and MCP server | Consent (Art. 6(1)(a)); submitting is optional | Top 100 entries kept until removed on request |
Analytics and your choice
PostHog is loaded only after you click Accept on the banner. Until then no PostHog script runs and nothing is stored for it. It is configured for page-level analytics only: no click autocapture, no session replay, no heatmaps, no surveys, and the client IP address is not stored on events. It also honours the browser Do Not Track setting. PostHog may process data on servers in the United States under standard contractual clauses; see posthog.com/privacy.
Vercel Web Analytics runs without cookies or a stored identifier and only produces aggregate counts. If you click Decline, its events are dropped as well. See Vercel’s analytics privacy notes.
You can change or withdraw your choice at any time via (also in the footer of every page). Withdrawing stops PostHog immediately and deletes the identifiers it stored in your browser. Withdrawal does not affect processing that happened before it.
Cookies and local storage
Everything this site stores in your browser:
| Key | Type | Set when | Purpose |
|---|---|---|---|
| cookie-consent | localStorage | You click Accept or Decline | Remembers your analytics choice (“accepted” or “declined”) |
| cookie-consent-date | localStorage | You click Accept or Decline | When the choice was made |
| ph_*_posthog | cookie + localStorage | Only after Accept | PostHog device ID and session; removed on Decline |
| pd_scores | localStorage | You save a Pipeline Defense score | Local copy of your recent scores |
The consent entries are strictly necessary to remember your choice and are not used for tracking. No third-party advertising or social-media cookies are set.
Who receives data (processors)
- Vercel Inc. (US): hosting, edge network, Web Analytics.
- PostHog Inc. (US): product analytics, only with consent.
- Upstash: Redis database holding the public leaderboard.
- Google (Gmail): the mailbox where direct contact emails land.
Each provider acts under its own data-processing terms. Where data leaves the EU or UK it relies on the EU-US Data Privacy Framework or standard contractual clauses; Israel, where the controller is based, holds an EU adequacy decision.
Contacting Rowan directly
Email, phone, and LinkedIn links on the site open your own apps; nothing is submitted through this site. Anything you send is used only to reply to you and is kept as long as the conversation is relevant.
Your rights
Under the GDPR you can ask to:
- access the personal data held about you and get a copy (portability);
- have it corrected or erased, for example a leaderboard name;
- restrict or object to processing based on legitimate interest;
- withdraw consent at any time without affecting earlier processing.
Send requests to [email protected]. Requests are answered within one month. If you are unhappy with the response you can complain to your local data-protection authority, for example any EU supervisory authority listed by the European Data Protection Board or the UK Information Commissioner’s Office.
Security, children, and changes
All traffic is served over HTTPS with a strict Content Security Policy; API endpoints are rate limited. The site is not directed at children under 16 and knowingly collects no data from them. Changes to this policy are published on this page with a new date; the machine-readable copy at /md/privacy is kept in sync.