Privacy & Terms.

Who runs this site.

mrvampcruz.com is a personal portfolio site operated by Altaaf Hamod (online handle: MrVampCruz), an individual based in Mauritius. It is not run by a company. For any privacy- or data-related question, the fastest channel is altaafhamod@mrvampcruz.com.

What the site collects.

This site collects data in two ways: (1) the contact form, when you choose to submit it; and (2) analytics — Microsoft Clarity and Yandex Metrika — which run on public pages only if you accept analytics cookies. If you reject or ignore the cookie banner, neither analytics script is ever loaded. Browsing does not require an account. This site does not run paid advertising pixels or sell your data.

1. Information you type in

When you submit the contact form, the following fields are sent to me along with your message:

• Name — whatever you put in the name field.
• Email address — so I can reply to you.
• Subject — optional.
• Message — the content you wrote.

2. Technical info your browser shares automatically

When you submit the form, the page also collects a snapshot of technical details about your device and browser that web pages can read without prompting you. This is used to help me debug issues, spot spam/automated submissions, and understand the context a message was sent from. Browsers do not expose your OS username or machine hostname to websites — those are never collected. Specifically:

• User agent string — your browser and OS identifier, plus related navigator fields (vendor, product, app name/version).
• User-Agent Client Hints — brands, platform, mobile flag, and (when the browser provides them) architecture, bitness, device model, platform version, full version list, WoW64, and form factors.
• Automation flag — whether the browser reports being driven by automation (navigator.webdriver), used only to spot bots.
• Language & languages — preferred languages set in your browser.
• Locale details — locale, calendar, numbering system, hour cycle, timezone, timezone offset, and local clock time at submit.
• Platform — e.g. Win32, MacIntel, Linux x86_64.
• Cookies enabled — whether your browser accepts cookies.
• Do Not Track — your browser's DNT preference, if set.
• PDF viewer enabled — whether a built-in PDF viewer is present.
• Online status — whether the browser reports being online.
• Hardware concurrency — number of logical CPU cores reported.
• Device memory — approximate RAM bucket reported by the browser (when available).
• Max touch points — for distinguishing touch devices.
• Screen & window metrics — screen size/available size/position, color/pixel depth, pixel ratio, orientation, viewport, outer window size, and scroll offsets.
• Display & input preferences — dark-mode, reduced-motion/transparency, contrast, forced/inverted colors, color gamut, hover/pointer capability, and display-mode media queries.
• Network connection — effective connection type, connection type, downlink, round-trip time and data-saver flag (when the browser exposes this).
• Navigation context — history length, document referrer, current URL parts, page title, visibility/ready state, and document character set.
• API / capability flags — presence of WebGL/WebGL2/WebGPU, service workers, storage APIs, Bluetooth/USB/HID/serial/keyboard APIs, notification permission, and secure-context flags.
• GPU / WebGL info — vendor, renderer, and unmasked GPU strings when the browser exposes them.
• Canvas & audio hashes — short non-reversible fingerprints derived from canvas drawing and an AudioContext graph (no audio is played).
• Battery status — charging state and level when the Battery Status API is available.
• Storage estimate — approximate quota/usage when available.
• Local/WebRTC IPs — host ICE candidates (often LAN addresses) gathered without contacting a STUN server; your public IP is taken from the server request separately.
• Plugins & MIME types — legacy plugin/MIME lists when the browser still exposes them.
• Speech synthesis voices — count, languages, and default voice name (OS language-pack signal).
• Performance memory — JS heap sizes when Chromium exposes performance.memory.

3. Information derived from the network request

Every HTTP request to a server includes some metadata. When you submit the form, the following are read from the request and stored alongside your message:

• IP address — taken from x-forwarded-for, x-real-ip, true-client-ip, or cf-connecting-ip headers, including the full forwarded chain and proxy protocol.
• User-Agent header — same browser identifier as above, as seen by the server.
• Accept, Accept-Language and Accept-Encoding headers.
• Client-Hint headers — low-entropy sec-ch-ua brand/mobile/platform, plus high-entropy arch/bitness/model/platform-version/full-version-list/WoW64/form-factors when the browser sends them after visiting /contact.
• Fetch metadata — sec-fetch-site, sec-fetch-mode, sec-fetch-dest, sec-fetch-user, and any DNT header.
• Referer, Origin, Host, and forwarded host/proto headers, plus the server-side receipt timestamp.
• Approximate location — country, and where Cloudflare provides it: city, region, continent, postal code, timezone, metro code and coarse latitude/longitude derived from your IP.
• Cloudflare diagnostics — Ray ID, visitor/TLS JSON, device type, ASN, JA3 hash and bot score when those headers are present.

Why this is collected.

• To reply to you — name, email, subject and message are needed to read and respond.
• Spam & abuse prevention — IP, user agent, country and request headers help filter out automated submissions and abuse.
• Debugging — if a message fails to deliver or arrives malformed, the technical snapshot helps me reproduce the issue.
• Security — to detect and respond to malicious traffic against the site or the contact endpoint.
• Site improvement (analytics) — heatmaps and session replay help me see what is confusing or broken so I can fix layout, navigation, and performance issues.

Contact-form data is not sold, rented, or used for marketing. Analytics data is processed by Microsoft and Yandex under their own terms; I use it only to understand and improve this website.

Legal basis

Where the GDPR or the Mauritian Data Protection Act 2017 applies, I rely on:

• Consent — for all analytics (Microsoft Clarity and Yandex Metrika) and any non-essential cookie. This is the only basis used for analytics, it is asked for up front, and it can be withdrawn at any time via Cookie settings.
• Legitimate interests — for handling your contact-form message, and for keeping the site and its endpoints secure and working (spam filtering, abuse prevention, debugging). My interest here is running a functioning, non-abused site; it's balanced against your privacy by collecting only the technical snapshot listed above and never using it for marketing.
• Legal obligation — if I ever have to retain or disclose something to comply with the law.

There is no automated decision-making or profiling that produces legal or similarly significant effects for you.

Where the data goes.

Submissions are forwarded from this site to a backend API that I operate, which sends the message to my personal mailbox and stores a record of the submission so I can keep track of conversations. The infrastructure path is:

• Cloudflare — fronts the site and the API; provides DDoS protection and the IP-country lookup.
• My backend API & mailer — receives the submission, stores it, and dispatches the email to me.
• Email provider — delivers the resulting email to my inbox.

Separately, and only with your consent, browsing data goes to the two analytics providers:

• Microsoft (Clarity) — behavioural metrics, heatmaps and session replay; processed on Microsoft infrastructure, primarily in the United States.
• Yandex (Metrika) — the same kind of data; may be processed in the Russian Federation. See the Yandex Metrika section above.

Analytics providers receive no contact-form content, and the contact form is never sent to them.

Data may transit through, or be stored in, jurisdictions outside your own — including the EU, the US and (for Yandex) Russia — as part of normal email/CDN routing and of the analytics you consented to. Some of these countries are not covered by an adequacy decision, and protections may be weaker than in your own jurisdiction. Rejecting analytics removes the Microsoft and Yandex transfers entirely.

How long it's kept.

• Email copy — kept in my mailbox for as long as the conversation is useful, just like any other email I receive.
• Stored submission record — kept while it's relevant for follow-up; deleted on request.
• Server / edge logs — short retention windows controlled by the hosting provider and Cloudflare, used for security and debugging.
• Analytics data — retained by Microsoft and Yandex under their own retention schedules, not mine. Clarity data is retained by Microsoft for a limited period (Microsoft documents this as around 13 months at the time of writing); Yandex applies its own schedule. I can't extend these, and I only ever view the reports.
• Your consent choice — stored in your browser only, until you clear it or change it. It never reaches my server.

Your rights.

You can ask me, at any time, to:

• Access — tell you what data I have about you.
• Rectify — correct anything that's wrong.
• Erase — delete your submission and any associated technical data.
• Restrict or object — stop processing your data further, including objecting to anything I rely on legitimate interests for.
• Port — hand back what you sent me in a portable, machine-readable format.

Withdrawing consent needs no email at all — use the Cookie settings link in the footer. It is as easy to withdraw as it was to give, and refusing costs you nothing: no feature of this site is withheld if you reject analytics.

For everything else, email altaafhamod@mrvampcruz.comfrom the address you originally contacted me with, and I'll action it — normally within 30 days, and free of charge. There is no form to fill in.

If you think I've handled your data badly, please tell me first — I'd rather fix it. You also have the right to complain to a supervisory authority: in Mauritius that is the Data Protection Office, and in the EU/UK it is your local data protection authority.

Children.

This site is not directed at children under 16. If you are under 16, please don't submit personal information through the contact form without a parent or guardian.

Terms of use.

By using mrvampcruz.com you agree to the following:

• Analytics & cookies. Analytics are opt-in: if — and only if — you accept them in the cookie banner, you consent to the collection described above by Microsoft Clarity (see the Microsoft Privacy Statement) and Yandex Metrika (see the Yandex Privacy Policy), including session replay and transfer of that data outside your country. You can withdraw at any time via Cookie settings, and nothing on this site is withheld if you decline.
• Age. This site isn't directed at under-16s — see Children above. Don't accept analytics cookies or use the contact form if you're under 16 without a parent or guardian.
• Content ownership. All site copy, design, code snippets and project descriptions are © Altaaf Hamod unless otherwise stated. You may quote short excerpts with attribution; please don't copy substantial portions or republish the design.
• Open-source code. Code I publish on GitHub is governed by its individual repository licence — read the LICENSE file in that repo, not this page.
• No warranty. The site and its content are provided as-is, with no guarantee of accuracy, availability, or fitness for any purpose. I'm not liable for any loss arising from use of the site.
• Acceptable use. Don't attempt to break, scrape aggressively, overload, or abuse the site or its endpoints. Don't submit unlawful, threatening, defamatory, or spam content through the contact form.
• External links. Some pages link to third-party sites (GitHub, LinkedIn, project demos, etc.). I don't control those sites and can't take responsibility for their content or privacy practices.
• Governing law. This site is operated from Mauritius. These terms and this policy are governed by Mauritian law, and the courts of Mauritius have jurisdiction — without stripping you of any mandatory protection you have under the consumer or data-protection law of your own country of residence.
• Changes. These terms and this policy may be updated occasionally. Material changes will be reflected in the "Last updated" date at the top, and if the cookie categories change you'll be asked for consent again rather than silently opted in.

Questions.

Anything unclear, or want to exercise a data right? Email altaafhamod@mrvampcruz.com. Real human, real reply.