Privacy Policy

This website (“Site”) is operated by Tymofii Vasin, based in Kraków, Poland (“I”, “me”, “controller”). For privacy questions or GDPR requests, contact tymofii.s.vasin@gmail.com.

This Privacy Policy explains what personal data is processed when you visit the Site or use the contact form, why it is processed, how long it is kept, and what rights you have.

This policy applies to the personal portfolio Site and related endpoints (including /api/contact). It does not cover third-party sites linked from the Site (GitHub, LinkedIn, Lichess, Goodreads, Letterboxd, Tutor, etc.). Those services have their own policies.

I process only what is needed to run the Site securely and to reply when you contact me.

• Contact form: name, email address, message text, and any file you choose to attach (PDF, image, or plain text within the stated size limits).
• Security / abuse prevention: approximate request timing, a short-lived CSRF cookie, IP address (hashed for rate-limit keys where applicable), and Cloudflare Turnstile bot-check tokens/results.
• Technical logs from hosting (Vercel) that may include IP address, user agent, timestamps, and requested paths — retained according to the host’s defaults for operations and security.
• Language preference stored in your browser localStorage (en / uk). This stays on your device unless you clear site data.
• Interactive demos (for example chess / Stockfish) run in your browser. Game positions and engine work are processed locally and are not sent to my servers as personal profiles.

Processing is based on the EU General Data Protection Regulation (GDPR), as I am based in Poland / the EEA.

• Responding to your messages and arranging meetings or work discussions — Art. 6(1)(b) (steps at your request before a contract) and/or Art. 6(1)(f) (legitimate interest in communicating with visitors).
• Securing the Site (CSRF protection, rate limits, spam/bot filtering, attachment checks) — Art. 6(1)(f) (legitimate interest in protecting the service and inbox).
• Operating and improving hosting reliability and diagnosing incidents — Art. 6(1)(f).
• Complying with legal obligations when they apply — Art. 6(1)(c).

The contact form uses Cloudflare Turnstile (invisible widget) to reduce automated spam and abuse. Turnstile may collect device and interaction signals needed to distinguish humans from bots.

Use of Turnstile is subject to Cloudflare’s terms and the Turnstile Privacy Addendum: www.cloudflare.com/turnstile-privacy-policy/

When Turnstile runs, limited verification data is sent to Cloudflare. I receive a success/failure result so the form can be accepted or rejected. I do not use Turnstile for advertising.

The Site does not use advertising or third-party analytics cookies.

• Essential security cookie: portfolio_csrf — httpOnly, SameSite=Strict, short-lived (about 2 hours). Used only to protect the contact form against cross-site request forgery.
• Cloudflare Turnstile may set its own cookies/storage as described in Cloudflare’s documentation and privacy materials.
• localStorage key portfolio-locale stores your language choice on your device.
• Hosting providers may use strictly necessary technical cookies for CDN/security. Check their policies for details.

I use specialised providers as processors / service providers. Depending on configuration, data may be processed in the EEA and/or other countries (including the United States). Where required, transfers rely on appropriate safeguards such as the EU–US Data Privacy Framework participation and/or Standard Contractual Clauses offered by the provider.

• Vercel — website hosting, serverless APIs, edge delivery, operational logs.
• Resend — transactional email delivery of contact-form messages (From address on my domain; replies directed to my inbox).
• Cloudflare — Turnstile bot protection.
• Upstash — Redis used for durable rate limiting of the contact API (IP/email rate-limit counters; not a marketing database).
• Email inbox provider (e.g. Google) — storage of messages once delivered to me.

I keep data only as long as needed for the purposes above.

• Contact emails and attachments: kept in my mailbox for as long as needed to handle the conversation, then deleted or archived under ordinary email practice. You may ask for deletion sooner.
• CSRF cookie: expires automatically (about 2 hours) or when cleared by the browser.
• Rate-limit records in Redis: short windows (on the order of minutes), then expire or are overwritten.
• Turnstile tokens: verified at submission time and not kept by me as a long-term profile.
• Hosting logs: per Vercel’s retention practices for security and operations.

If GDPR applies to you, you may request access, rectification, erasure, restriction, objection to processing based on legitimate interests, and data portability where applicable. You may also lodge a complaint with your supervisory authority. In Poland, that is the President of the Personal Data Protection Office (UODO): uodo.gov.pl/

To exercise rights, email tymofii.s.vasin@gmail.com with enough detail to identify the request. I may need to verify your identity before acting.

I apply reasonable technical and organisational measures for a personal site: HTTPS, security headers (including CSP and HSTS in production), origin checks, CSRF tokens, rate limiting, bot checks, and attachment type/size validation. No method of transmission or storage is perfectly secure; please avoid sending passwords, payment card numbers, or highly sensitive documents through the form.

The Site is aimed at adults (recruiters, collaborators, peers). It is not directed at children under 16. If you believe a child submitted personal data, contact me and I will delete it where appropriate.

I may update this policy when the Site or legal requirements change. The effective date at the top will be revised. Continued use of the Site after changes means you have read the updated policy. Material changes may also be noted on the Site.

Tymofii Vasin · Kraków, Poland

Email: tymofii.s.vasin@gmail.com

Site: tymofiivasin.com