Privacy Notice

Who runs this site

This is the personal portfolio of Cordero Core, an individual based in Seattle, Washington, United States. For anything privacy-related, use the contact form and choose the General inquiry type.

What this site collects

The contact form. If you submit it, the following is stored: your name, email address, organization (if you provide one), and your message, along with your IP address and country, which are recorded automatically with the submission. Submissions are stored in a database and a copy is delivered to my inbox by email.

The newsletter. Signing up for my letters stores your email address, when you signed up, and the exact consent wording you saw, along with your IP address and country, recorded automatically for abuse forensics. Nothing is sent until you confirm from your own inbox (double opt-in). Every letter carries a working unsubscribe link; unsubscribing stops all sending immediately, and you can ask for full deletion via the contact form.

Analytics. I use PostHog to see how this site actually gets used: which pages people read, what they click, where they get stuck, and how many newsletter signups make it all the way through confirmation. To connect one visit to the next, PostHog gives your browser a random ID and keeps it in a cookie and in local storage. That ID is the only thing tying your visits together. Your name and email address are never sent to it. When you send the contact form or sign up, unsubscribe, or confirm on the newsletter, PostHog only hears that it worked (and, for the contact form, which inquiry type you picked).

PostHog also records sessions, which means a replay of how a page was scrolled and clicked. Anything you type into a form field is masked in your browser before the replay is sent. Like any web service, PostHog receives your IP address, and it uses that to estimate a rough location. If a page breaks while you’re on it, the error report goes to PostHog too. If your browser blocks PostHog, nothing on this site stops working.

Bot protection. The contact form and the newsletter signup use Cloudflare Turnstile to distinguish people from bots. Turnstile evaluates connection and browser signals and may set strictly-necessary cookies to do so; it is not advertising or analytics tracking. Its processing is described in Cloudflare’s privacy policy.

Hosting. This site is served by Cloudflare, whose infrastructure maintains standard server logs (such as IP addresses) for security and operations under its own policies.

What this site does not do

No advertising. No social-media pixels. No cross-site tracking: the analytics above see this site and nothing else, and their only job is helping me make it better. Your information is never sold, rented, or shared for anyone else’s marketing. Full stop.

Why it’s collected

To read and respond to your inquiry, and to send the newsletter you explicitly signed up for (consent in both cases), to keep the forms usable by preventing spam and abuse, and to understand how the site is used so I can improve it (legitimate interests in both cases). IP and country are kept with submissions solely for abuse and spam forensics. Nothing is used for profiling or automated decisions.

Where it lives and who touches it

Submissions and newsletter records are stored on Cloudflare infrastructure in the United States (Cloudflare D1). Contact submissions reach my inbox through Cloudflare’s email service. Newsletter emails, from the confirmation link to every letter after it, are sent through Resend, which needs your email address to deliver them. Analytics data is stored by PostHog in the United States. Each of them works as a service provider under its own data protection terms, and no one beyond these three receives your information.

How long it’s kept

Contact submissions are retained for up to 24 months from submission, in line with standard practice for business correspondence, then deleted. If an inquiry becomes an ongoing engagement, related correspondence may be kept for the duration of that engagement and as required for legal or accounting records. Newsletter records are kept while you’re subscribed; after you unsubscribe, your address is retained only as a do-not-mail marker unless you ask for full deletion. Analytics data is kept on PostHog’s standard schedule for this project.

Your rights and choices

You can ask what I hold about you, ask for a copy, ask me to correct it, or ask me to delete it, through the contact form. I honor these requests regardless of where you live, including rights under the EU/UK GDPR and the California Consumer Privacy Act where they apply. You won’t be treated differently for exercising them. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority. Analytics are anonymous, so I can’t look them up by your name. Clearing this site’s cookies and storage gives you a fresh random ID and breaks the link to your past visits.

Security

Traffic to this site is encrypted (TLS). Stored submissions are accessible only to me, protected by Cloudflare’s infrastructure security and scoped credentials. No system is perfectly secure, but the attack surface here is deliberately small.

Links elsewhere

This site links out to Medium, Substack, LinkedIn, GitHub, ORCID, X, and others. Once you leave, their privacy policies govern, not this one.

Changes

If the site’s data practices change, this notice will be updated and the effective date revised. Meaningful changes won’t be applied retroactively to information collected under an earlier version.