Skip to content

Legal

Privacy Policy

Effective

This policy explains how Joshua Yamamoto-Kim (“I”, “me”) collects, uses and protects information when you visit https://portfolio.joshuyk.com. I collect as little data as possible and never sell it.

1. Information I collect

  • Contact form: your name, email address, optional company, the subject you choose and your message.
  • Abuse prevention: a one-way keyed hash of your IP address, stored briefly to limit repeated submissions. Raw IP addresses are not stored.
  • Bot protection: the contact form uses Cloudflare Turnstile, which processes technical signals from your browser to tell humans and bots apart. See Cloudflare’s privacy policy.
  • Account sign-in (site administration only): if you sign in with GitHub, your GitHub name, email address, avatar and account id are stored to maintain your session.
  • Server logs: standard technical logs (such as request time and errors) kept for security and reliability.

2. Cookies and local storage

This site uses only strictly necessary storage:

  • An authentication session cookie (HttpOnly, Secure) — only if you sign in.
  • Security cookies set by Auth.js during sign-in (CSRF protection and OAuth state).
  • Your cookie-banner choice, saved in your browser’s local storage under cookie-consent-v1.
  • Your light or night mode choice, saved in a theme cookie (only if you use the toggle).

No advertising or cross-site tracking cookies are used.

3. How I use information

  • To read and reply to messages you send.
  • To protect the site from spam, abuse and security threats.
  • To operate the administration area for authorised users.

4. Sharing

Information is shared only with service providers needed to run the site — hosting, the database, email delivery for contact notifications and Cloudflare Turnstile — or when required by law.

5. Retention

Contact messages are kept for up to 12 months and then deleted. Rate-limiting records expire automatically within minutes. Sessions expire after seven days of inactivity.

6. Security

Data is transmitted over HTTPS, stored in an access-controlled database with row-level security, and processed following least-privilege principles. No method of transmission or storage is completely secure, but reasonable measures are taken to protect your information.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, or to object to its processing. To make a request, email portfolio@joshuyk.com.

8. Changes

This policy may be updated from time to time. The effective date above shows when it last changed. See also the Terms & Conditions.