Who is responsible
Hani Al Naber, Houston, Texas, United States. Contact: hanialnaber@gmail.com.
Analytics, only with your consent
When you first visit, a banner asks whether you allow analytics. Until you click Accept, no analytics script loads and no analytics cookie is set. Reject is just as easy, and closing the banner counts as a no. If your browser sends a Global Privacy Control signal, we treat it as a no and don’t show the banner.
If you accept, two tools record your visit:
- PostHog (PostHog Inc.), on its EU cloud in Frankfurt, Germany. It records the pages you view, when, the referring page, clicks on the contact and résumé links, your browser, device and screen size, under a random visitor ID. It may derive an approximate location (country or city) from your IP address, but the address itself is discarded and not stored. It does not know your name or email. PostHog acts as my processor under its data processing agreement.
- Google Analytics 4 (Google LLC, United States) records the pages you view and clicks on the contact and résumé links, with device, browser and approximate location. Google acts as my processor under its data processing terms.
Legal basis: your consent (GDPR / UK GDPR Art. 6(1)(a), and the ePrivacy rules on cookies). You can withdraw it at any time with , also in the footer of every page. Withdrawing stops the tools and deletes their cookies from this site. It doesn’t affect anything recorded before you withdrew.
Cookies and storage
- site_consent (needed, 6 months): remembers your choice and a random ID for the record of that choice.
- hani-motion (needed, browser storage): remembers whether you paused animations.
- ph_*_posthog (analytics, only after consent, up to 1 year, cookie and browser storage): PostHog’s visitor and session IDs.
- _ga, _ga_* (analytics, only after consent, up to 13 months): Google Analytics visitor IDs.
Cookieless visit counts
Until 4 November 2026 this site also counts page views on the server with Umami, a self-hosted tool. It sets no cookie and stores nothing on your device. It sees the address and browser of each request only to derive an approximate location (country to city) and a non-reversible visitor hash, and does not keep the IP address. Legal basis: my legitimate interest in knowing which pages are read (Art. 6(1)(f)). After that date it will be switched off.
Server logs
Like any website, the hosting provider (Railway) keeps short-lived request logs with IP addresses for security and troubleshooting.
How long data is kept
PostHog: 1 year, then deleted automatically. Google Analytics: 14 months at most. Consent records: as long as the choice is valid, plus the time needed to show that consent was given.
Sharing and transfers
I don’t sell or share your personal information for advertising, and I don’t use it to build ad profiles. PostHog data is stored in the EU (Germany). Google Analytics data is processed in the United States; for visitors from the EU, UK and elsewhere those transfers rely on the EU–US Data Privacy Framework and standard contractual clauses. Railway processes data under its data processing agreement.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR, California’s CCPA/CPRA, the UAE’s Personal Data Protection Law or Jordan’s Personal Data Protection Law), you can ask to access, correct, delete or receive a copy of your data, object to or limit its use, and withdraw consent. Email hanialnaber@gmail.com. I answer within 30 days. You can also complain to your data protection authority.
Children
This site isn’t aimed at children under 16.
Changes
When this policy changes, the date at the top changes. If the analytics change, the banner asks you again.