Privacy Policy

This is a personal portfolio site. It has no accounts or logins, uses no advertising or cross-site tracking cookies, and never sells your data. The places any data is touched are the optional AI assistant and privacy-friendly visitor analytics, both described below, plus the ordinary technical processing every website involves: the host (Vercel) receives each request in order to serve it, and pages load web fonts from Google Fonts, which receives your IP address and browser type the way any embedded resource does.

The site offers an optional AI chat assistant ("Ask about Travis") that answers questions about Travis's background and work. This site does not store, log, or retain conversations, apart from one narrow security exception described below. Outside that exception, nothing you type is saved here, and no record of your questions is kept by this site after the reply is generated. The model provider's own retention is separate and is described in the next paragraph.

To produce a reply, your message is sent to Anthropic, the provider of the Claude model, and is handled under Anthropic's terms. Anthropic does not use data submitted through its API to train its models. Anthropic processes this data in the United States. Anthropic keeps its own copy on its own schedule: its published policy is to delete API inputs and outputs within 30 days, and to keep them for up to 2 years if its systems flag content as violating its usage policy. So "not stored" on this page means not stored by this site; it does not and cannot speak for the model provider. The assistant draws only on a curated, public summary of Travis's background; it has no access to private data.

The assistant also stores a short random session ID in your browser (via sessionStorage, which clears when you close the tab) so it can count messages per session. It holds no personal data.

To prevent abuse, the site keeps a short-lived request counter for up to 24 hours, then deletes it automatically. The counter is keyed to a one-way keyed hash (HMAC, using a secret this site holds) of your IP address and session ID, never the raw IP and never any message content. A hashed IP can still count as personal data, so it is treated that way and discarded within 24 hours.

One narrow security exception. If a single message you send matches a pattern that looks like an attempt to probe or attack the assistant (for example, prompts that try to extract the assistant's instructions, environment variables, or credentials), that one message is stored for up to 30 days, alongside the same kind of one-way keyed hash of your IP described above, a label for the pattern it matched, the assistant's reply to that message, and the time it happened. The reply is kept for the same reason as the message: it is the only way to confirm the assistant declined correctly and disclosed nothing. This is used only to investigate abuse of the assistant. It is automatically deleted within 30 days, and no other conversation content or normal questions are retained. Pattern matching is not judgment, so an ordinary question can occasionally match; when that happens the same 30-day deletion applies and the record is used for nothing else.

Your right to object. The security exception above and the abuse counter described earlier are what this site does on the basis of its own legitimate interest, rather than because you asked for it. You can object to either at any time, on grounds relating to your particular situation. Email hello@travisfraser.com with the approximate date and, if you can, the opening words of the message you sent, which is the only reliable way to find one record rather than someone else's. It will be deleted unless there is a compelling reason to keep it, which in practice means an active abuse investigation or a legal claim. You do not need to explain yourself beyond that, and asking costs you nothing. In most cases the answer will be that the record already expired on its own before your email arrived.

The site uses Vercel Web Analytics to understand aggregate traffic such as page views and referrers. It is privacy-friendly: it sets no cookies, does not track you across other sites, and does not build a profile of individual visitors. The data is aggregated and not used to identify you.

Counting crawlers. Separately, the site keeps its own count of how much of its traffic comes from automated crawlers and AI agents rather than from people. Web analytics runs on JavaScript, and crawlers don't run JavaScript, so they are invisible to it; this is the only way to see them at all. The count runs at the edge, before a page is served. For requests it identifies as automated, it records the crawler's name, and for the narrower set that appear to be acting on someone's behalf, the page requested; where a crawler isn't recognised, its user-agent string is kept so a rule can be added for it later. If you are a person, the only thing recorded is a single increment to that day's total. No IP address is read or stored, no cookie is set, no session is created, and nothing recorded can be traced back to an individual. Everything here is a plain per-day counter, and all of it is deleted automatically after 90 days. The question being asked is what share of this site's readers are machines, which is a question about the web rather than about you.

• No accounts, logins, or passwords
• No advertising or cross-site tracking cookies
• No sale or sharing of personal data with data brokers
• No health, location, or financial data about visitors

What is collected. In full, these are the categories of personal information this site can hold about you:

• IP address — used to serve the request and, in one-way keyed hash form, to count requests for abuse limiting. The raw address is never stored by this site.
• Browser and device type — sent by your browser with every request, as with any website.
• A random session identifier — held in your browser tab, used to count messages per session.
• Message content — only in the narrow security case described above, and only for that one message and its reply.
• Aggregate page views and referrers — via analytics, not tied to you.

No personal information is sold, and none is shared with advertisers or data brokers. Data reaches these categories of third party only, and only for the purpose named:

• Hosting and delivery (Vercel) — serves every page and request, and runs the chat function
• AI model provider (Anthropic) — receives your chat messages in order to generate a reply, under its own retention policy described above
• Data store (Upstash) — holds the hashed abuse counters, the crawler traffic counts, and any security record
• Analytics (Vercel Web Analytics) — aggregate traffic only
• Fonts (Google Fonts) — receives your IP and browser type when a page loads its fonts
• Source control (GitHub) — receives a count and a timestamp when flagged messages are reported for review. No message text, no reply text, and no IP hash leave the data store for this purpose

Do Not Track and Global Privacy Control. This site does not sell or share personal information and does not track visitors across other websites, so there is nothing for a Do Not Track or Global Privacy Control signal to opt you out of; the behavior described on this page is what every visitor already gets. If that ever changes, GPC signals will be honored as opt-out requests.

Because the site keeps no accounts and stores no conversation history beyond the narrow security exception described above, there is essentially no personal data to retrieve or delete; the abuse counter deletes itself within 24 hours, and any security record within 30 days. If you have a question about any data the site may hold, or you want a security record deleted, email Travis and he'll address it. See your right to object above. You can also ask for a copy of anything held about you, ask for it corrected, or ask for it erased. If you are in the UK or EU and think this site has handled your data badly, you also have the right to complain to your national data protection authority.

Tracking by others. This site does not build a profile of you or follow you to other sites. It cannot speak for the third parties listed above: Google Fonts receives your IP address and browser type when a page loads its fonts, and Google operates across much of the web, so it may be able to observe that request in a wider context. If you would rather avoid that, a content blocker that blocks fonts.googleapis.com will do it, and the site remains fully readable without those fonts.

This site is operated by Travis Fraser as an individual. Questions about this policy? Reach him at hello@travisfraser.com. This policy may be updated from time to time; the date above reflects the current version.