Privacy policy.

I’m Yasser Shkeir, and I run this site as an individual rather than a company. If you are in the EU or the UK, that makes me the data controller for everything described here. Reach me at hello@yasser-shkeir.com.

Start here, because it is most of the policy. This site has no way to recognise you, and no place to put anything about you.

• No accounts. There is no sign-up, no login, no profile, nothing to be logged into.
• No database. The site has no datastore of any kind — no SQL, no key-value store, no file storage. There is nowhere for your data to be kept even if I wanted to keep it.
• No cookies. This site sets none. Not analytics, not preferences, not advertising. That is why you were never asked to consent to any.
• No browser storage. Nothing is written to localStorage, sessionStorage, or IndexedDB.
• No fingerprinting. No user-agent parsing, no canvas or WebGL probing, no device enumeration, no location prompt.
• No ad or surveillance tech. No Google Analytics, no Tag Manager, no Meta Pixel, no Hotjar, no session recording, no chat widget, no scheduling embed.
• No third-party fonts, images, or embeds. The fonts are served from this site’s own domain, there are no images loaded from anyone else, and there is not a single iframe. Loading a page here sends no request to Google.
• No mailing list. No newsletter, no signup, and no tracking pixels in the mail I send.
• Nothing is sold, shared, or profiled. There is no data broker in this picture and no advertising in it either.

Two forms on this site transmit anything, and both do the same thing: turn what you typed into an email addressed to me. Neither writes to a database, because there isn’t one.

• The contact form (/contact) sends your name, email address, company if you filled it in, the type of work you picked, your budget range if you picked one, and your message.
• The sponsorship inquiry (on the sponsor page) sends your name, email address, company if you filled it in, the project you selected, and your message. It also sends a confirmation to your own address, so that address is used to mail you once.

Both go out through Resend, the email service that delivers them, and land in my inbox — where they sit as ordinary email until I delete them. The contact form delivers to a Gmail address, so Google holds that mail as my email provider.

Whatever you type into a message box travels with it. Treat both forms as email, because that is all they are: don’t put anything in there you wouldn’t send by email.

One more path worth knowing about: the contact endpoint is published for AI assistants under /.well-known/, so an agent can submit an inquiry on your behalf with the reply address you gave it. If that happens, what reaches me is exactly what the agent sent.

I never see your card. The tiers on the sponsor page are links that hand you over to Stripe’s own checkout. Whatever you enter there — card number, name, email, address — you give to Stripe, which handles it as its own controller under its own privacy policy. Stripe also sees that you arrived from the sponsor page, and the tag on the link saying which project you had selected.

What comes back to this site: nothing. There is no webhook, no confirmation page, and no code here that runs when a payment succeeds. What I can see is what Stripe shows me in its dashboard. With no database on my side, I hold no donor record at all — no ledger, no receipt copy, no list.

Two scripts from Vercel run on every page: Web Analytics and Speed Insights.

Vercel’s documentation states that Web Analytics uses no third-party cookies and instead identifies a visitor by a hash of the incoming request, which it discards after 24 hours. The data points it records are the timestamp, the URL and route, the referrer, filtered query parameters, coarse location (country, region, city), operating system, browser, device type, and script version. There is no visitor-level profile in it and nothing in it I could trace back to a person.

Speed Insights reports page-timing measurements — how fast a route loaded and responded. Same provider, same policy.

No page on this site carries personal data in its URL, so nothing sensitive ends up in a page-view record. If you would rather neither script ran, a content blocker stops both and the site works exactly the same without them.

Vercel hosts this site, so it receives every request and keeps standard access logs that include IP addresses. That is the host’s platform behaviour under Vercel’s policy, not something this site’s code does.

What my own code does with it:

• The contact endpoint reads your IP address to rate-limit the form. It is held in the memory of the single server instance that handled your request — never written to a database, never logged, never sent anywhere, and gone when that instance is recycled. The sponsorship endpoint reads no IP at all.
• The contact endpoint’s error logging is deliberately stripped down to the type of error. Message contents and email addresses are never logged.
• The sponsorship endpoint is less careful: if the email service rejects a send, it logs that provider error in full. Since one of the two mails it sends goes to your address, a rejection could in principle put that address in a function log. It is an edge case rather than routine behaviour, and I would rather write it down here than leave it out.

A short list, and what each one actually receives:

• Vercel — hosts the site, so it sees every request and its IP address, and it runs the two analytics scripts described above.
• Resend — delivers the mail from both forms, so it receives every field you submitted and, for a sponsorship inquiry, your address as a recipient.
• Google — the contact form’s messages are delivered to a Gmail address, so Google stores that mail as my email provider.
• Stripe — only if you click through to a checkout. It then receives whatever you enter on its page.
• GitHub — the open-source section on the homepage asks api.github.com for public repository stats from your browser, so GitHub sees your IP address and browser as a side effect. Nothing about you is sent in the request; it is a public read of my own repositories.

Each is an independent company operating under its own privacy policy, and each may process data outside the country you are in.

• Your message and my reply — steps taken at your request before a possible engagement, and otherwise my legitimate interest in answering people who write to me. The sponsorship confirmation is part of the same.
• Rate limiting and error logs — legitimate interests: keeping the forms usable and finding out when they break.
• Analytics — legitimate interests: knowing which pages are read. It is cookieless and aggregate, with no visitor profile in it, which is why it does not sit behind a consent prompt.
• Payments — Stripe is the controller for what you enter on its checkout and relies on its own bases for it.

There is no automated decision-making here and no profiling of any kind.

With no database, only a few things have a lifespan at all:

• Your message — stays in my inbox until I delete it. There is no scheduled purge. Ask and I will delete it.
• The rate-limit IP — lives in one server instance’s memory and disappears when that instance is recycled.
• Function and access logs — kept by Vercel for whatever period its platform provides. Not something I set.
• Analytics data — kept by Vercel under its own policy.
• Payment records — kept by Stripe for as long as its own obligations require. I hold no copy.

If the GDPR or UK GDPR applies to you, you can ask for a copy of what I hold, ask me to correct it, ask me to delete it, ask me to restrict what I do with it, ask for it in a portable form, and object to anything I do on the basis of legitimate interests.

In practice, everything I hold about you is the email you sent me. So “access” means I send it back to you and “deletion” means I delete it out of my inbox. Email hello@yasser-shkeir.com and say which you want. There is no fee and no form. If I need to confirm you are the person who sent it, I’ll reply to the address the message came from.

For data held by Stripe or Vercel, those companies hold it and you can go to them directly — tell me and I’ll point you at the right place.

You can also complain to a supervisory authority: in the EU, the one for the country you live in; in the UK, the Information Commissioner’s Office.

This page describes how the site is actually built, so it changes when the site does. If a datastore, a cookie, or a new third-party script ever ships here, this page changes in the same breath and the “last updated” date at the top moves with it.

Anything about your data, or about this page: hello@yasser-shkeir.com.