Privacy Notice

1. Introduction

This privacy notice explains what limited technical data is collected when you visit this site (mikeshepperd.com), why it is collected, how it is used, and your options. This site is a personal website and does not intentionally collect personally identifiable information (PII) beyond basic technical request metadata necessary for security, analytics, and operational integrity.

2. What Data Is Collected

When you load a page, a lightweight tracking script sends metadata to the server, and the server also records standard request headers. A typical full visit entry may include:

• IP address (for security, abuse prevention, approximate geography). When present, proxy and CDN headers such as X-Forwarded-For and CF-Connecting-IP are also recorded.
• Server timestamp (UTC) and client-reported local timestamp
• Requested URL and referring URL
• Browser user agent and accepted languages
• Screen resolution, available screen area, and viewport size (from client script)
• Time zone identifier (e.g., America/New_York)
• Basic HTTP headers (Accept, Accept-Encoding, Cache-Control)
• Geolocation lookup result: country code, city, region, and ISP (used for access control and operational context)
• Repeat visit counter (if multiple hits occur within a 10‑minute window)
• Anonymous visitor ID and session ID (randomly generated UUIDs stored in a cookie and session storage, respectively) to distinguish new from returning visitors and track page-per-session counts
• Engagement metrics: time spent on each page (dwell time) and maximum scroll depth percentage, sent when you leave or hide the page
• Click events: outbound link clicks (destination domain), file downloads (filename), and contact-link clicks (email/phone) are recorded with timestamps. No keystroke or form-input data is captured.
• Campaign parameters: if the URL includes standard UTM tags (utm_source, utm_medium, utm_campaign, etc.), those values are recorded alongside the page visit

Not collected: names, emails (except when you click a mailto link, the address is logged), precise location, payment data, form contents, or advertising identifiers.

3. How and Why Data Is Used

• Security & Abuse Mitigation: Rate limiting, origin validation, and anomaly detection (e.g., floods) rely on IP and headers.
• Operational Analytics: Basic understanding of traffic volume, technology usage (screen sizes, user agents), and referrers.
• Geofencing & Access Control: Certain site functions are restricted by geographic region.
• Performance & Capacity: Rotation of logs guards against disk exhaustion.

4. Legal Basis (If Applicable)

This is a personal informational site. For visitors from jurisdictions requiring a legal basis (e.g., GDPR in the EU), collection of minimal technical data is based on the legitimate interest of maintaining site security and functionality.

5. Data Retention

• Main log rotates automatically when it reaches ~1 MB.
• Rotated logs older than 30 days can be removed via periodic cleanup.
• Per-IP deduplication cache entries persist only during the active 10‑minute window and are overwritten.
• Geolocation cache entries persist up to 24 hours per IP.

6. Third-Party Services

IP geolocation is determined using free third-party lookup services. Only the visitor IP is shared with these services; no additional enrichment is requested. Each provider has its own privacy terms. Transient API responses are cached in memory during the session only.

7. Cookies & Tracking Technologies

This site sets the following cookies:

• _ms_vid: A randomly generated anonymous visitor ID (UUID). Expires after 1 year. Used to distinguish new from returning visitors. Contains no personally identifiable information.
• _ms_ret: A simple flag indicating a prior visit. Expires after 1 year.

A session-scoped identifier (_ms_sid) is stored in browser session storage and cleared when the tab closes. No analytics cookies from third parties, advertising trackers, or fingerprinting techniques are used.

8. Data Security Measures

• Authenticated access controls with rate limiting and backoff on protected endpoints.
• Origin and referer validation on data submission endpoints.
• Geographic and network-based access restrictions where appropriate.
• Log size rotation to reduce impact of spam attempts.
• Restricted direct access to raw log files via server configuration.

9. Your Options & Rights

If you wish to request removal of log entries containing your IP, or have questions about this notice, you may contact the site owner. Provide the approximate timestamp(s) and your IP so the relevant records can be located. For EU/EEA or other privacy-regulated regions, you may request limited access or erasure of raw technical log data subject to security considerations.

10. Opt-Out Considerations

This site currently does not implement a formal Do Not Track (DNT) opt-out since only minimal technical metadata is collected. You can block the lightweight tracker via browser extensions or network filtering; core access logging (server-side) will still record IP and request headers as part of normal web operation.

11. Changes to This Notice

Material changes will update the version number and effective date. Historical versions may be retained offline for reference.

12. Contact

To inquire about this privacy notice or request log review/removal, email: privacy@mikeshepperd.com