Privacy policy

When you send a quote request

The quote form asks for what I need to reply to you. When you send it, the following is stored:

• Your name.
• Your email address.
• Your company, if you give one.
• Your budget, if you give one.
• Your message.
• The project you asked about, if you came to the form from one.
• The price estimate, if you attached one from the services calculator: its currency, its indicative total, and between 1 and 50 items, each an offer and its quantity.
• When the request was received, and an identifier for it.
• For each of the two emails described below: whether it is waiting to be sent, sent, or failed; how many times sending it was tried; and when the next try is due.

I use it to answer your request and prepare a quote, and for nothing else.

Where it is stored

Your request travels over HTTPS to the site's API at api.tianweb.dev, which stores it in a database on a server in Indonesia that I rent from Biznet Gio. The database is not reachable from the internet: only the site's own services on that server can reach it.

The API's logs name a request by its identifier only, never by your name, email address or message.

How long it is kept

A stored request is deleted automatically 24 months after it was received. You can ask me to delete it sooner, as described under “Your choices” below.

The automatic deletion covers the stored request. It does not reach the notification email in my inbox, described below; I delete that too when you ask me to delete your request.

The emails a request sends

The site sends two emails through Resend, an email delivery service, which receives their contents in order to deliver them:

• A notification to me, in my Gmail inbox, provided by Google, carrying everything you entered on the form, and the estimate if you attached one.
• A confirmation to you, at the email address you entered, saying your request was received. It carries nothing else you entered, not even your name.

Whether each email was sent is kept with your request, as listed above, for the same 24 months.

The security check

When you reach the step that sends your request, the form loads Cloudflare Turnstile, a check that tells people apart from automated spam, whether or not you then send a request. To do that, Cloudflare processes your IP address, a fingerprint of your browser's secure connection (its TLS fingerprint), your browser's User-Agent, and this site's Turnstile key and address, among other signals. Cloudflare also uses them to improve Turnstile, as a decision of its own.

When you send a request, the site's API sends Cloudflare only the token the check produced, not your IP address. Cloudflare explains its side in its Turnstile privacy policy.

Limiting requests

To stop abuse, the API limits how many requests it accepts from one IP address in an hour; for IPv6, the addresses of one network count as one. To count them, it holds your address (for IPv6, only its network part) with the times of your recent requests. It holds them in its memory only, never writes them to the database or a log, and forgets them whenever it restarts.

When you browse the site

The site is hosted by Vercel. Like any web host, Vercel receives your IP address and the details your browser sends with each request.

Vercel tells the site which country your connection comes from. The site uses it only to choose the currency prices are shown in, Indonesian rupiah in Indonesia and US dollars elsewhere, and keeps that currency, not your country, in a cookie named currency. That cookie is the only one the site sets itself. A currency guessed from your country is a session cookie, which your browser drops when your browsing session ends; a currency you choose with the switcher is kept for a year.

If you switch between light and dark, your choice is kept in your browser's local storage under the name theme. It stays in your browser and is never sent to the site.

The site also keeps a few display settings in your browser's session storage, such as whether the opening animation has played or is paused. They hold nothing personal, are never sent to the site, and are cleared when you close the tab.

Analytics

Each page sends a page view to Vercel Web Analytics, and measurements of how quickly it loaded and responded (its Web Vitals) to Vercel Speed Insights. I use them to see which pages are read and whether the site is fast.

Web Analytics uses no third-party cookies. It identifies a visitor by a hash created from the incoming request, and discards the visitor session after 24 hours; what it records is anonymous, not tied to you or your IP address. It records the time, the page and its path, the page you came from, filtered query parameters, a geolocation, your device type, and your operating system and browser with their versions, as Vercel's Web Analytics privacy policy describes.

Speed Insights is anonymous: it does not identify you or reconstruct your visit. It records the page and its address, your network speed, browser, device type and operating system, your country, each measurement and what caused it, and when it was received, as Vercel's Speed Insights privacy policy describes.

Your choices

You can ask me what is stored about you, to correct it, or to delete it, by writing to septiandev028@gmail.com from the address you used on the form. I will reply by email once it is done.

You can clear the currency cookie, the theme choice and the display settings at any time in your browser's settings.

Changes to this policy

When this policy changes, the date at the top of this page changes with it.