Legal
Privacy policy
Version: 2026-11
Updates. This policy describes exactly what the site collects. When it changes, the version and date are shown at the top of the page.
1. Controller
This website (luanhuynh.dev) is operated by Luan Huynh ("I"), the data controller. Privacy contact: contact@luanhuynh.dev.
2. What I process, why, and on what legal basis
The legal basis for both groups below is your consent. You can decline and still use the whole site.
A. Visit analytics (only after you click "Accept" in the banner)
Purpose: understand which pages, sources and demos are of interest so I can improve content. Not used for advertising, not sold or shared with third parties, no personal profiles.
| Data | Detail |
|---|---|
| Page | page path (query string removed, except utm_source, utm_medium, utm_campaign) |
| Source | referrer host name, UTM parameters |
| Coarse location | country and region derived by Cloudflare from the IP; city is not stored (feature is off) |
| Device | device class (desktop/mobile/tablet), browser, operating system as coarse groups; the raw User-Agent is not stored |
| Language, screen | browser language, screen size class (xs to xl) |
| Behaviour | page views, engaged time on page, scroll milestones 25/50/75/100%, names and steps of actions inside the demos (never what you type) |
| Session id | random string in the browser's sessionStorage, gone when the tab closes or after 30 minutes idle; not a cookie |
| Daily visitor id | one-way hash of IP and User-Agent with a secret key and the date (truncated to 64 bits); changes every day, so you cannot be followed across days; used only to count unique visitors per day |
The IP address is not stored in the analytics database or logs; it is processed momentarily in memory to compute the hash and derive the country. No device fingerprinting (canvas, fonts, etc.) and no IP-to-company lookup. Do Not Track / Global Privacy Control signals are treated as a refusal. If you decline, nothing is sent.
B. Contact / quote form
Purpose: answer your request and quote. You must tick the contact-consent box to submit.
| Data | Detail |
|---|---|
| You provide | name, email, message, budget band, service of interest (optional), interface language |
| Recorded with it | time of submission, version of this policy you agreed to |
| Source | only if you also accepted analytics: referrer, UTM, page you were on |
| Abuse control | counter keyed by a hash of the IP (not the IP), max 5 requests/hour, deleted after at most 2 days |
When you submit the form, a notification containing your name, email and message is sent to my mailbox (through Cloudflare Email Routing). The submission is also stored in the database and I read it in a private admin page.
C. Remembering your choice
Your choice is stored in your browser's localStorage (key consent.v1) so you are not asked again. It is needed to honour your choice and is not sent to the server.
Cookies. The public site sets no cookies. The admin area (site owner only) uses Cloudflare Access authentication cookies.
3. Retention
- Analytics data: 12 months, then automatically deleted daily.
- Abuse-control counters: at most 2 days.
- Form submissions: until you ask for deletion; I will review them periodically and delete when no longer needed.
4. Processors and international transfer
Cloudflare, Inc. processes data on my behalf (site hosting, Workers, D1 database, Cloudflare Access, DNS, email forwarding). Form notification emails are received in my own email service, operated by a provider outside Vietnam. Data may be processed in data centres outside Vietnam. I do not sell data or share it with other third parties unless required by law.
5. Your rights
Under Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP you may: be informed, give or refuse consent, access, correct, delete, restrict processing, object, withdraw consent, request a copy of your data, complain and bring claims. Write to contact@luanhuynh.dev; I will acknowledge your request within 2 business days and handle it within the legal deadlines: withdrawing consent, restricting or objecting to processing within 15 days; access, correction or a copy of your data within 10 days; deletion within 20 days. These may be longer for complex requests or when a processor must assist, and I will tell you why. Analytics data is not tied to your identity, so I may not be able to locate your own records; form data is handled by email.
6. Withdrawing consent
At any time through the "Privacy settings" link in the footer: choose "Reject". The tracker stops immediately and the session id is deleted. Withdrawal does not affect processing done before (collected analytics data is auto-deleted after 12 months; you can ask for earlier deletion by email).
7. Children and changes
The site is not aimed at people under 16. When this policy changes I will update the version and ask for consent again if the processing changes materially.