Privacy
Privacy Policy
What this site collects when you send a project brief, who it is shared with, and how to ask for it back or removed.
This page describes, in plain language, what this site actually does today. If that changes, this page changes with it and the date at the bottom moves.
Who is responsible for your data
This site is operated by Felipe Parra, based in México. For anything on this page, write to info+website@felipeparra.dev.
What is collected, and when
The site itself does not require an account and sets no tracking cookie. Data is collected in two places:
The project brief form: the free text you write describing your project, and the email address you provide so a reply can reach you. Both are only sent when you press Send.
Every submission: your IP address, read from the request and used only to enforce a short-lived sending limit (see "Abuse prevention" below). It is never stored alongside your brief or email.
Analytics events, only if analytics is configured and you accept it — see "Analytics" below.
Why we may process this
Brief and email: legitimate interest in responding to an inquiry you initiated, and — once we exchange messages about a project — steps taken at your request before entering into a contract.
IP for rate limiting: legitimate interest in keeping the contact form usable and free of automated abuse.
Analytics, when configured: your consent. It remains off unless you choose Accept analytics, and you can change or withdraw that choice using Analytics preferences at the end of every page.
Who else sees this data
Resend (email delivery, resend.com) — always. Sending a brief transmits your draft and email address through Resend to deliver it. When a verified sending domain is configured, Resend also delivers a receipt copy of your own brief back to your address; when it is not configured, no receipt is sent and only the primary delivery happens. Resend acts as an independent processor of the message it transmits — see its own privacy policy for how it handles data in transit.
PostHog (product analytics, posthog.com) — only if analytics is configured and you accept it in this browser. As shipped, analytics ships DISABLED: no key is configured, so PostHog is never loaded and no analytics cookie is set. When it is switched on, it is configured to record catalogue events only (page views and interface interactions such as which offer or project card you opened) with autocapture off, session recording off, and memory-only persistence — meaning no cross-visit identifier and no cookie even while active. We never call an "identify" operation, so no PostHog record is ever linked to your name or email.
Vercel Web Analytics (page-view counts, vercel.com) — only if analytics is configured and you accept it in this browser, under the same choice as PostHog. It sets no cookie and keeps no cross-visit identifier. Before anything is sent, the query string and fragment are stripped from the address, so only the page path (for example /en/privacy) is reported. Vercel also hosts this site, so it already handles each request to serve the page.
No other third party receives brief content, your email address, or your IP address. Data is never sold.
Abuse prevention (IP address)
Each submission is checked against a short-lived, in-memory limit (currently five submissions per ten minutes per IP address) to stop automated spam. This record is kept only in the server process's memory, is never written to a database or log file, and is cleared automatically as soon as an entry ages past the ten-minute window or the server process restarts.
How long data is kept
Your brief and email address arrive as an ordinary email and are kept for as long as needed to respond to and, where a project proceeds, deliver it — then deleted or archived under ordinary email housekeeping. IP addresses used for rate limiting are never persisted; they exist only in server memory for up to ten minutes, as described above. Analytics events, when enabled, contain no identifying fields to begin with (see "Who else sees this data") and are retained under PostHog's own project-level settings.
Your rights
You can ask to access, correct, or erase the brief and email address you sent us at any time, by writing to info+website@felipeparra.dev from the address you used to contact us (so the request can be matched and verified). We will act on a valid request within a reasonable time and confirm once it is done.
Because no account or persistent visitor identifier exists, there is nothing analytics-side to look up by name or email — the erasure route above covers everything the site holds that could identify you.
Changes to this policy
If what the site collects or who it shares data with changes, this page is updated and the date below moves.