Who is responsible

Matheus Carvalho is responsible for the personal data processed by this portfolio. Contact me using the email below for privacy questions or requests.

Optional analytics: only with your consent

If you accept, first-party analytics helps me understand which work interests visitors, how people navigate and whether a browser returns. The legal basis is your consent. Rejecting or withdrawing does not limit access to the portfolio.

• Pages and navigation times; source hostname, country, interface language and selected themes.
• Normalized actions such as opening a project or clicking a CV or contact link; scroll and visible-time milestones. Typed text, form contents, full session replay, microphone and camera contents are not analytics data.
• Coarse viewport, browser/platform family, fixed error categories and observed performance bands help reproduce problems. Error messages, stacks, resource URLs, device hardware and typed content are excluded. Unsupported metrics remain unmeasured.
• A session identifier and a server-generated pseudonymous signature derived from the request IP address and browser user agent. This can connect visits with the same signature; it is not proof of a person's identity.
• Interaction and request signals used to estimate human or automated activity. These are uncertain classifications, not verified identities or conclusions about a visitor.

Retention and changing your choice

Automatic deletion is currently disabled. Analytics records and separate consent evidence remain stored until removed manually or an erasure request is fulfilled; the permanent retention period is under review. Consent evidence includes a pseudonymous key, policy version, grant time and first/last receipt times. The browser stores your choice in mc_analytics_consent and a signed HttpOnly proof for up to 180 days. Clearing the choice cookie leaves optional analytics off until you choose again. Browser-cookie expiry does not automatically erase server records.

Use Privacy settings in the footer to accept or reject at any time. Withdrawal stops future optional analytics from this browser; it does not undo processing that was lawful before withdrawal or automatically identify and delete earlier records. Contact me if you want to request access or deletion. Do not send passwords, identity documents or unnecessary personal information.

General server counts without visitor identifiers

The server increments monthly counters for fixed page groups and themes explicitly present in requested URLs. These separate totals apply with or without optional consent. They store no visitor/session ID, IP, browser user agent, referrer, full URL, individual timestamp or page/theme pair. They do not recognise returns or reconstruct a journey. Repeat loads and bots are included; these are request counts, not unique people. Aggregated monthly totals can remain as historical statistics.

Data needed to operate the site

Hosting and API providers receive technical request data, which can include your IP address, browser user agent, requested URL and timing, to deliver pages and protect the service. This is separate from optional audience analytics. The basis for necessary delivery and security processing is the legitimate interest in operating and protecting this site.

Preferences and tools may use browser storage for the theme, language, accessibility settings, progress, game saves and files you choose to work on. These functional uses are separate from consented audience analytics. Their lifetime depends on the feature and your browser storage; you can clear them in your browser.

Games, tools and AI features

Submitting a score or nickname to a public game leaderboard sends it to the game API for display. Only submit information you want to make public. These submissions are separate from optional analytics and are kept until removed or a deletion request is fulfilled. A functional browser token lets you manage your own scores and online-game rating; browsing a leaderboard does not create a new token.

Tools have different processing needs. Many process files in your browser, but this is not a promise that every feature is local. If you use the AI chat, your submitted messages are sent through this site's server to the configured OpenAI or Anthropic provider to answer your request. Avoid sending sensitive information. Review each feature's explanation before using it.

Providers and international processing

The site uses Vercel for web hosting and Fly.io for the API. Depending on the feature you request, OpenAI or Anthropic may also process submitted content. Providers can process technical data outside the European Economic Area under their applicable terms and safeguards.

Provider logging, retention and international transfer arrangements are separate from the application analytics records. Contact me for information about the arrangements applicable to your request. This notice does not certify that every provider or international transfer has been independently audited.

Your rights

Where the GDPR applies, you can request access, correction or erasure of personal data, restriction, portability where applicable, and object to processing based on legitimate interests. You can withdraw analytics consent as easily as you gave it, through Privacy settings. These rights depend on the circumstances and do not require you to allow more tracking.

Because visit records use pseudonymous signatures, I may be unable to identify an earlier record from a name alone. I will explain what can be located without collecting extra identification unnecessarily. You can also complain to the data protection authority in the EU country where you live, work or believe an infringement occurred.