Privacy Policy

Last updated: October 11, 2026

This is the personal portfolio website of David Davitkovski ("I", "me"). I respect your privacy and try to collect as little data as possible. This page explains what data is collected when you use this site, why, who processes it, and what your rights are.

The short version

• You can browse this site without giving me any personal information.
• I only receive personal data when you choose to send me a message or buy the $1 surprise.
• There are no advertising or tracking cookies. The analytics I use are cookie-free and don't identify you.
• I don't sell or share your data for marketing, and I don't use AI to process it.
• You can ask me to see or delete your data at any time.

Who is responsible for your data

David Davitkovski is responsible for (the "controller" of) the personal data described here. For any privacy question or request, email david.davitkovski.it@gmail.com.

What I collect and why

Contact form. When you send a message, I receive your email address and your message. I use them only to read and reply to you. The legal basis is your consent and my legitimate interest in answering messages sent to me. The message is delivered to my email inbox through Resend.

The $1 surprise purchase. Payments are handled entirely by Stripe on their own checkout page. I never see or store your full card details. Stripe shares with me the payment amount, its status, and the email address and country you enter there. I use this only to deliver what you bought, handle refunds, and meet accounting and tax obligations. The legal basis is the performance of our contract and my legal obligations.

Analytics and performance. I use Vercel Web Analytics and Vercel Speed Insights to see aggregated page views and how fast the site loads. They don't use cookies and don't identify individual visitors. They record things like the page visited, referring site, country, browser and device type. The legal basis is my legitimate interest in understanding how the site is used and keeping it fast.

Server logs. Like almost every website, the hosting provider (Vercel) automatically processes technical data such as your IP address and browser details when you load a page. This is needed to deliver the site and protect it from abuse.

Login protection. To stop password guessing on the private admin login page, each sign-in attempt there is recorded with a one-way hash of the IP address (never the address itself). These records are deleted automatically after one hour. Visitors who don't use the login page are not affected.

Stored in your browser. The site saves your light/dark theme choice and your Snake high score in your browser's local storage. This data stays on your device and is never sent to me. You can clear it any time through your browser settings.

Spotify section. The "now playing" and top-tracks lists show my own Spotify listening activity. No data about you is sent to Spotify unless you click a link and open Spotify yourself.

Cookies

This site doesn't set advertising, analytics or tracking cookies, so there is no cookie banner. The only cookies are strictly necessary login cookies for the private admin dashboard, which only I use. Stripe may set its own cookies on its checkout page to process payments and prevent fraud. See Stripe's cookie policy.

Third-party services (processors)

These services process data on my behalf to run the site. Each one has its own privacy policy:

• Vercel: hosting, analytics and performance metrics (privacy policy)
• Resend: delivers contact form messages to my inbox (privacy policy)
• Google (Gmail): my email inbox, where messages arrive (privacy policy)
• Stripe: payment processing for the $1 surprise (privacy policy)
• Supabase: database and file storage for the site's content (projects, images, CV). It stores no visitor data (privacy policy)

Some of these providers are based in the United States, so your data may be processed outside your country. They protect international transfers with recognised safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Artificial intelligence

This site doesn't use artificial intelligence or automated decision-making to process your personal data, and your messages are not used to train AI models. If that ever changes, I will update this policy before it happens.

How long I keep your data

• Contact messages: for as long as needed to handle our conversation, and no longer than 2 years after the last message, unless you ask me to delete them sooner.
• Payment records: as long as tax and accounting law requires (usually up to 10 years). Stripe keeps its own records under its policy.
• Analytics: aggregated and anonymous, kept according to Vercel's retention settings.

Your rights

Depending on where you live (for example under the GDPR), you have the right to:

• ask what personal data I have about you and get a copy of it;
• have incorrect data corrected;
• have your data deleted;
• object to or restrict how I use it;
• withdraw your consent at any time;
• receive your data in a portable format;
• complain to the data protection authority in your country.

To use any of these rights, email david.davitkovski.it@gmail.com. I will reply within 30 days. It's free.

Children

This site isn't aimed at children under 16, and I don't knowingly collect their data. If you believe a child has sent me personal data, contact me and I will delete it.

Security

The site is served over HTTPS, the admin area is protected by authentication and database-level access rules, and secret keys never reach your browser. No system is 100% secure, but I take reasonable steps to protect your data.

Changes to this policy

If I change how data is handled, I will update this page and the "Last updated" date above. Purchases are also covered by the Terms of Use.