Privacy notice

Who I am

This site, kumarchandrachooda.com, is my personal portfolio, blog and design system. I'm Kumar Chandrachooda, based in Leeds, United Kingdom, and I'm responsible for the personal data described here. You can reach me at kumarchandrachooda@gmail.com.

If you just read the site

You don't need an account. I don't use analytics, advertising or tracking of any kind, and no third-party scripts run on these pages. Two cookies may be set, and both are strictly necessary.

• __Host-kc.prefs remembers the reading preferences you choose, such as theme and motion. It lasts a year and holds no identifier.
• __Host-kc.antiforgery protects forms on the site from cross-site requests.

Your browser's local storage keeps things like where you are in a series and how you like lists shown. That stays on your device and is never sent to me. The site runs on Amazon Web Services, and like any web server it keeps short operational logs of requests so the site keeps working and stays secure. Those logs are deleted after 30 days.

If you sign in

Accounts are by invitation. When you sign in with Google, GitHub or Microsoft, I keep

• your account: an identifier, your display name, your email address, when it was created and its status,
• the sign-in you used: the provider, the provider's identifier for you, a label, and when you linked it and last used it,
• your sessions: when each started and when it expires (after 30 days), a short digest of your browser's description (enough to say “Firefox on a Mac”) and a coarse part of your IP address, so that you can see your sessions and end them,
• your role on the site, for example a recruiter pass, which lasts 90 days, and why it was given,
• a record of security actions on your account, such as signing in again before a sensitive change.

Two more cookies are set while you are signed in. __Host-kc.session keeps you signed in, and __Host-kc.oidc lasts only for the trip to your sign-in provider and back. If you publish writing on the site, your byline, profile and what you publish are public.

Google user data

With Google sign-in I ask only for your basic profile (openid, email and profile). I use your Google account identifier, email address and name only to sign you in and to show your name on the site. I don't use Google user data for advertising, I don't sell it, I don't share it with anyone, and I don't use it to train AI models.

Why I use it

To provide the account you asked for, and to keep it secure.

Where it is kept, and who else sees it

The site itself runs on Amazon Web Services, in the United States. Your account, your sessions and the site's other records are kept in two databases that other companies run for me. Supabase keeps the PostgreSQL one, on Amazon Web Services in Frankfurt, Germany, and MongoDB Atlas keeps the MongoDB one. Nobody else sees it apart from AWS, Supabase and MongoDB, who host the site and its databases, and the sign-in provider you chose, who already holds your account.

If you add the site to your AI assistant, the site counts its calls under a salted hash of your IP address and your assistant's name, never the address itself. Each count is kept in a MongoDB database for one minute. The site's log, kept 30 days like any other, records which tool your assistant called and the name it gives itself, never what it asked or your IP address.

If you connect your own AI key, it stays in your browser, and the site never receives it.

What you send to an AI company is between you and them. I never sell personal data.

How long I keep it

Account data stays until you delete your account or ask me to. Sessions end after 30 days, and passes after 90. When an account is deleted, anything you published stays on the site, and security records keep only an identifier that no longer leads to you.

The count of an AI assistant's calls is kept for one minute, and the log of which tools it called for 30 days.

Your rights, and the way out

You can ask to see, correct or delete what I hold about you, or ask me to stop using it. If you'd like your details wiped, email kumarchandrachooda@gmail.com from the address you used here. I'll delete everything I hold about you within one month and tell you when it's done. If you have an account, you can also delete it yourself from your account page.

If you're unhappy with how I've handled your data, you can complain to the UK's data protection regulator, the ICO (formally the Information Commission since 30 September 2026), at ico.org.uk.

Changes

Each version of this notice is dated and kept at its own address. If I change how I use your data, I'll update this notice first, and if the change affects Google user data I'll ask for your agreement before it applies.