What this site records

This is my site, and I'm the only person who sees what it records. If you have a question about any of it, email mirza@najafov.dev.

Visits

I record how the site is used, to see what people read, what doesn't work and whether a job application led to a visit. The recording uses no cookies and stores nothing in your browser.

When a page is shown, it sends me which page it is and the domain of the site that linked to it, how long the page and each of its parts were in front of you and how far down you read, which links to my repos, demos, CV, LinkedIn or email you clicked, how fast the page loaded and answered, and the message of any error in the site's own scripts. If the link you followed has a short code after ?r=, I put it there when I sent a job application, so a visit with a code most likely comes from that company.

From the request itself, the server works out the kind of device and browser, and the country, city and network owner of your IP address, using an offline database (IP Geolocation by DB-IP). To tell that two pages were seen by the same visitor on the same day, it mixes your IP address (for IPv6, its network part) and your browser's User-Agent with a random value that is replaced at midnight UTC, and the old one is deleted within hours. Only the result is stored. Your IP address is never stored, and once that value is gone nobody, me included, can work out which address a record came from.

These records are deleted once their UTC day is 30 full days old, so each lives 30 to 31 days. What stays after that has no visitor in it. For each day I keep, for 25 months, how long each visit lasted and how many were on a phone, how each page was read on each kind of device (views, seconds, scroll, the parts read, how fast it loaded, answered and held still), which missing pages were asked for, where visits came from, their countries and the links clicked. On a quiet day those totals may cover a single visit. Whether a link I sent with a job application was opened is kept as a daily count for as long as I track that application.

If your browser sends Global Privacy Control or Do Not Track, nothing is recorded, not even a count. Without JavaScript nothing is sent. Visits from known bots aren't recorded, only counted.

Demos

The demos below load a small script from this site that records a visit to them the same way: which part of the demo you opened (the first part of its address only) and the domain of the site that linked to it, how long it was in front of you, how far down you scrolled, and which of the demo's main steps you did. Nothing you type into a demo is sent.

A demo page opened on the same UTC day as a page of this site, from the same browser and network, counts as the same visit, through the same daily value as above. That is how I can see whether someone who read about a demo also tried it. If you came through a link I sent with a job application, the demos you opened that day are recorded as part of that application's visit, and the links to the demos in a CV I sent carry the same code. Everything above applies to the demos too: Global Privacy Control and Do Not Track record nothing, bots are only counted, and the records are deleted on the same schedule. For each day I keep, for 25 months, how many visits clicked a link to each demo, opened it and from which kind of site they came, how many did each step and how long they stayed. The demos are separate apps with their own data, such as a Matchium account, and this page covers only what they send here.

Questions you ask

I keep questions for 30 days to see where the answers fail, then they are deleted. A question is tied to the visit it was asked in by the same daily mix of address and User-Agent as above, so I can see what a visit wanted to know. With Global Privacy Control or Do Not Track on, a question is still answered and kept, but tied to no visit. Questions are rate limited by your network mixed with that same daily value, so the address itself is never stored.

Backups

Every day, and before each update of the site, the server makes a backup of the records above, so that a mistake can't lose them. The daily random value and the rate limit counts are never in a backup. A backup is deleted by the first daily run after it turns 7 days old, so a deleted record can stay in a backup for up to 8 more days. The backups stay on the same server.

Why, and your rights

I rely on my legitimate interest in knowing whether the site and my demos work for the people they are for and whether my applications reach anyone (Article 6(1)(f) GDPR). You can object at any time: turning on Global Privacy Control or Do Not Track stops it for every later visit (a question you ask is still kept, tied to no visit), and if you email me the day and rough time of a visit, I'll find and delete what was recorded. You can ask what I have about you, and you can complain to a data protection authority. Nothing is sold or shared. This site loads no third-party scripts, and the demos load their recording script from this site.