Privacy Notice

1. Introduction

This privacy notice explains what limited technical data is collected when you visit this site (mikeshepperd.com), why it is collected, how it is used, and your options. This site is a personal website and does not intentionally collect personally identifiable information (PII) beyond basic technical request metadata necessary for security, analytics, and operational integrity.

2. What Data Is Collected

When you load a page, a lightweight tracking script sends metadata to the server, and the server also records standard request headers. A typical full visit entry may include:

IP address (for security, abuse prevention, approximate geography)
Timestamp (UTC)
Requested URL and referring URL
Browser user agent and accepted languages
Screen resolution and viewport size (from client script)
Time zone identifier (e.g., America/New_York)
Basic HTTP headers (Accept, Accept-Encoding, Cache-Control)
Geolocation lookup result: country code only (US gating)
Repeat visit counter (if multiple hits occur within a 10‑minute window)

Not collected: names, emails, precise location, payment data, form contents, cookies for tracking, or behavioral interaction details.

3. How and Why Data Is Used

Security & Abuse Mitigation: Rate limiting, origin validation, and anomaly detection (e.g., floods) rely on IP and headers.
Operational Analytics: Basic understanding of traffic volume, technology usage (screen sizes, user agents), and referrers.
Geofencing & Access Control: Admin interface restricted to US traffic and an allowlisted IP fallback.
Performance & Capacity: Rotation of logs guards against disk exhaustion.

4. Legal Basis (If Applicable)

This is a personal informational site. For visitors from jurisdictions requiring a legal basis (e.g., GDPR in the EU), collection of minimal technical data is based on the legitimate interest of maintaining site security and functionality.

5. Data Retention

Main log rotates automatically when it reaches ~10MB.
Rotated logs older than 30 days can be removed via admin cleanup.
Per-IP deduplication cache entries persist only during the active 10‑minute window and are overwritten.
Geolocation cache entries persist up to 24 hours per IP.

6. Third-Party Services

Country code determination uses free IP geolocation providers in failover sequence (ipapi.co, ip-api.com, ipinfo.io). Only the visitor IP is shared; no additional enrichment is requested. Each provider has its own privacy terms; transient API responses are not stored beyond caching the country code.

7. Cookies & Tracking Technologies

No analytics cookies, advertising trackers, or fingerprinting techniques are intentionally used. Standard browser headers and client-provided resolution data are collected solely for operational insight and security.

8. Data Security Measures

Passphrase-protected admin access with rate limiting and backoff.
Origin and referer validation on logging endpoint.
IP allowlist fallback for admin access when geolocation fails.
Log size rotation to reduce impact of spam attempts.
Restricted direct access to raw log files via server configuration.

9. Your Options & Rights

If you wish to request removal of log entries containing your IP, or have questions about this notice, you may contact the site owner. Provide the approximate timestamp(s) and your IP so the relevant records can be located. For EU/EEA or other privacy-regulated regions, you may request limited access or erasure of raw technical log data subject to security considerations.

10. Opt-Out Considerations

This site currently does not implement a formal Do Not Track (DNT) opt-out since only minimal technical metadata is collected. You can block the lightweight tracker via browser extensions or network filtering; core access logging (server-side) will still record IP and request headers as part of normal web operation.

11. Changes to This Notice

Material changes will update the version number and effective date. Historical versions may be retained offline for reference.