Privacy Policy

The short version

This is a personal portfolio run by one person. It has no sign-up, no login, no newsletter, no comment thread and no contact form — there is no field anywhere on this site that asks for your name, your email address, or anything else about you, so none of that is collected or stored.

What does happen: the web server logs requests, and, only if you allow them, two analytics services run — Google Analytics for traffic, and Microsoft Clarity, which records heatmaps and session replays of how pages are actually used. Neither loads until you say yes to the question at the foot of the screen, and you can change your answer here at any time. Both are described in full below. None of it is sold, and none of it feeds advertising.

Who is responsible

Marshall Ezra Kevinnettou (“Maezkev”), an individual based in Indonesia. This is a personal portfolio, operated on my own behalf and not for any employer or client — including the companies named in the case studies. Where the law uses the word, I am the controller of the data described on this page.

Questions about this policy, or a request concerning your own data, reach me through LinkedIn, which is the contact route this site publishes.

What this site’s own code stores

No cookies, and nothing about you. The pages are static HTML, CSS and JavaScript with no application behind them. The site’s own scripts set no cookies and send nothing anywhere. They keep a few small values in your own browser, which never leave it:

• analytics in localStorage — your answer to the analytics question, so it is asked once rather than on every page.
• lite in localStorage or sessionStorage — whether the site is running its lighter version, for a slow device or one that asked for it.
• The search index, in sessionStorage — so the search does not rebuild it on every page, gone when the tab closes.

Every typeface is served from this domain rather than a font CDN, so simply reading a page does not announce your visit to a third party for the fonts. The cookies that do get set come from the two analytics services and the prototype embeds described below, and from nothing else.

Server logs

The site runs on shared Apache hosting, and the host keeps standard access and error logs. Each entry records roughly what every web server has recorded since the 1990s:

• Your IP address — personal data in most jurisdictions, including under Indonesian and EU law, which is why it is listed first.
• The URL requested, and the referring URL if your browser sent one.
• Your user-agent string — browser and operating system.
• Timestamp, response code and bytes sent.

Why: these logs exist to keep the site running and secure — diagnosing a broken page, seeing what a spike in traffic was, identifying abuse. They are a necessary part of operating a web server rather than something collected by choice, which is the legitimate-interest basis they rest on. They are not joined up with analytics data, not used to build a profile of you, and not read routinely. The host rotates and deletes them on its own schedule.

Google Analytics

Google Analytics 4, loaded through Google Tag (gtag.js) once you have allowed it, property G-7Y6Z9JNBYT. It reports which pages get read, how visitors arrive, and roughly where they are — the questions a portfolio is worth measuring at all. It sets first-party cookies (named _ga and _ga_<id>) to tell a returning visit from a new one.

What it collects: pages viewed and the order they were viewed in, time on page, approximate location derived from your IP address (typically city level), device type, screen size, browser, operating system, language, and the referrer that brought you. Google states that it does not store the full IP address for Analytics but uses it to derive that approximate location.

This data is processed by Google and is subject to Google’s Privacy Policy; how Analytics handles data specifically is described in Google’s privacy and terms for businesses. Google Signals, advertising features and ad personalisation are not enabled on this property, so the measurement stays counting rather than becoming ad targeting.

Microsoft Clarity

Microsoft Clarity, project y25bx6b5wi, and the service on this site that records the most about a visit — which is why it gets its own section. Clarity produces heatmaps and session replays: a reconstruction of your visit that can be played back afterwards, showing where the pointer moved, what was clicked, how far each page was scrolled, and how long each part took.

It is used for one purpose, and it is a design purpose rather than a marketing one: finding where the site itself fails. A replay is what shows a click landing on something that only looks clickable, or a case study being abandoned at the same scroll depth by everyone. Being able to see that is the difference between guessing at a layout problem and watching it happen.

What is recorded: pointer movement, clicks and taps, scroll depth, rage clicks and dead clicks, page dimensions, the pages visited, plus device, browser, operating system, referrer and approximate IP-derived location. Clarity sets its own cookies to stitch a session together, and connects to clarity.ms while you read.

What is not recorded: Clarity masks text input by default, and this site gives it nothing to mask anyway — there is no form, no login and no text field on any page, so there is no keystroke, credential or message here to capture. Replays carry no name attached to them; a session is an anonymous sequence of interactions, not an identified person.

Clarity is operated by Microsoft and the data is processed by Microsoft, under the Microsoft Privacy Statement. Microsoft documents its own retention period for Clarity recordings — 30 days at the time of writing, with aggregate metrics kept longer. If session replay is the part of this page you object to, the opt-out below stops it.

Prototype embeds and outbound links

Three case studies — RupaOne, Angop! and Logitech Arx Control — embed a live Figma prototype in an iframe. Loading one of those pages loads content from figma.com, which means Figma can set its own cookies and see that a request was made from this site. That is Figma’s processing under Figma’s Privacy Policy, not mine, and no other page on the site loads an embed of any kind.

Links out to LinkedIn and the sites shown in the case studies are ordinary links: nothing is shared when the page loads, and following one puts you under that site’s own privacy policy. Contacting me through LinkedIn means the message and whatever your profile shows sit with LinkedIn on LinkedIn’s terms — this site has no contact form precisely because it holds no message of yours.

The résumé PDF is served from this domain. Downloading it is a request like any other and appears in the server log and in analytics as a page event; the file contains my details, not yours.

What is never done

• Nothing is sold, rented or traded. There is no commercial arrangement of any kind involving data from this site.
• No advertising, and no ad profiling. The site carries no ads, no ad network, no conversion pixel and no retargeting tag. Google Signals and Analytics advertising features are switched off.
• No email address is collected — there is no field to type one into, and no mailing list.
• No accounts, no payments. Nothing is sold through this site, so no payment or billing detail is ever handled.
• No data broker enrichment. Analytics data is not cross-referenced against any external list to work out who a visitor is.

How to switch the analytics off

All of it is optional, and none of it is load-bearing — every page works identically without either service. Neither loads until you allow it, and your answer can be changed here whenever you like. Saying no after a yes clears both services’ cookies from this site straight away.

Beyond that, in rough order of how easily each is done:

• Block the scripts. Any content blocker — uBlock Origin, Brave’s shields, Safari’s and Firefox’s built-in tracking protection — already stops both services. This is the most complete option, because it prevents the scripts from running rather than asking them to behave.
• Refuse third-party and analytics cookies in your browser settings, or read the site in a private window and close it afterwards.
• Google’s own opt-out. The Google Analytics Opt-out Browser Add-on disables Analytics on every site, not just this one.
• Clarity’s opt-out is described in the Microsoft Privacy Statement, and Microsoft honours the Global Privacy Control signal your browser can send.

A browser that sends the Global Privacy Control signal is taken at its word: the site never loads either service for it, and does not ask.

Your rights

Indonesian law — Law No. 27 of 2022 on Personal Data Protection (UU PDP) — gives you the right to know what is processed about you, to have it corrected, to have it deleted, to withdraw consent, and to object to the processing. If you are in the EEA or the UK, the GDPR gives you materially the same set, plus data portability and the right to complain to your supervisory authority.

A candid limit on all of that: the analytics data here is pseudonymous. It arrives as cookie identifiers and session recordings with no name attached, and this site never asks you for one. So if you ask me what is held about you, I usually have no way to find your session among the rest — not as a refusal, but because the identifier that would connect you to it is in your browser and not in my records. Where I genuinely cannot identify your data, the practical remedies are the opt-outs above and clearing this site’s cookies, which severs the identifier at your end.

Deletion requests that can be actioned are those held by the processors: both Google and Microsoft provide their own data-subject request routes, and a request to me for a Clarity recording or an Analytics record will be passed on to them where the record can be located. Ask through LinkedIn.

Where the data goes

Google and Microsoft are both United States companies operating global infrastructure, so analytics data about your visit is processed outside Indonesia and, for EEA and UK visitors, outside the EEA and the UK. Each relies on its own transfer mechanism — standard contractual clauses and, for EU–US transfers, the EU–US Data Privacy Framework — set out in the privacy documents linked above. The site’s own files and server logs sit with the hosting provider.

How long it is kept

• Analytics — for the retention window configured in Google Analytics, after which Google deletes user-level and event-level data. Aggregate reports outlive the underlying rows.
• Clarity recordings — for Microsoft’s documented retention period, 30 days at the time of writing.
• Server logs — rotated and deleted by the host on its own schedule.

Nothing from any of the three is copied into a separate store of my own, so there is no fourth, longer-lived pile of it.

Children

This is a professional portfolio aimed at recruiters, clients and other designers, and it is not directed at children. No age is asked for and none is inferred. If you believe a child’s data has somehow been captured here, tell me and I will have it deleted where it can be located.

Changes to this policy

If the site changes what it collects — a contact form, a different analytics service, anything that adds a third party — this page changes with it, and the date in the header above moves. There is no mailing list to notify, so the date is the honest signal: if it has not moved, nothing here has.

See also Terms & Conditions for the terms of using the site, and Credits & Attribution for the full list of third-party code and assets it is built with.