Privacy policy.

This is a personal portfolio. It sells nothing, has no accounts, and runs no advertising. The short version: the only personal data I ever receive is what you deliberately type into the contact form or the site assistant. Everything else is anonymous, aggregate, or optional.

Who is responsible for your data

Site operator

Shrirang Mahajan

Status

Individual (sole operator — this is a personal site, not a company)

Location

Pune, Maharashtra, India

Contact

shrirangmahajan123@gmail.com

Website

https://www.shrirangmahajan.in

Hosting

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA

I am the data controller (under the UK/EU GDPR) and the data fiduciary (under India's Digital Personal Data Protection Act, 2023) for this site. There is no company behind it and no DPO — write to me directly at shrirangmahajan123@gmail.com and I will answer personally.

What I collect, and why

1. The contact form

If you send me a message, I receive your name, email address and the message you wrote. That is all three fields the form has — there are no hidden ones. I need the email to reply, and the name so I know who I am replying to.

• Legal basis: your consent, given by ticking the box on the form (GDPR Art. 6(1)(a)); consent under DPDP s. 6.
• Processor: the form is delivered by Formspree, Inc. (United States), which forwards it to my email inbox (Google Workspace / Gmail).
• Retention: messages stay in my mailbox while the conversation is live and for up to 24 months after the last reply, then they get deleted. Ask me sooner and I will delete immediately.

2. The site assistant (the "Ask" chat)

The chat on the home page sends whatever you type into it, plus a fixed description of my own projects and experience, to Groq, Inc. (United States) for inference. Your conversation is also kept in your browser's sessionStorage so it survives page navigation; closing the tab erases it.

• Legal basis: your consent, given by choosing to type into an optional chat box.
• Please don't type anything sensitive, confidential or personal into it. I have no need for it, and I can neither see nor delete what a third-party model provider logs.
• Retention: I do not store or receive a copy of these conversations. Groq's retention is governed by its own policy.

3. Analytics

Google Analytics runs only if you accept it in the cookie banner. Nothing Google-owned is loaded before that. When enabled, it is configured with IP anonymisation on and Google Signals and ad-personalisation off, so it is used for audience measurement and nothing else. Legal basis: consent (GDPR Art. 6(1)(a); ePrivacy Art. 5(3)). See the cookie policy.

Vercel Web Analytics and Speed Insights run on every visit. They are cookieless and store no identifier on your device: they record a page path, referrer, country, and coarse device/browser type, and derive a rotating, non-reversible hash for visit counting. I cannot identify you from them. Legal basis: my legitimate interest in knowing whether the site works and which pages are read (GDPR Art. 6(1)(f)). Object at any time by writing to me.

4. Server logs

My host, Vercel, records standard request logs (IP address, timestamp, URL, user agent) for security and abuse prevention. This is Vercel's processing under its privacy policy; I do not have access to raw logs and do not use them.

What I never collect

• No accounts, passwords, or payment details — none exist here.
• No advertising or cross-site tracking pixels. No data is sold.
• No special-category data (health, religion, politics, biometrics) is asked for, and please don't volunteer any.
• The TinyGPT demo downloads a model file and runs it entirely in your browser. Your prompts and its outputs never leave your device and never reach me.

Third parties your browser contacts

Because this is a static site with embedded content, loading a page can cause your browser to connect to the services below — which means they receive your IP address and user agent as an unavoidable part of serving a request. Web fonts are not among them: every typeface is served from this domain, so reading a page hands your IP address to no font provider.

• Vercel — hosting, analytics, speed insights.
• Google Analytics — only after you opt in.
• Hugging Face — serves the TinyGPT model weights, but only when you click to load the demo.
• GitHub (api.github.com, raw.githubusercontent.com) — repository data and some project images, plus an embedded GitHub Sponsors button in Jupyter mode.
• Groq — only when you use the site assistant.
• Formspree — only when you submit the contact form.
• Tenor (a Google service) and Icons8 — animated images and icons embedded in some blog posts and in Jupyter mode.

International transfers

I am in India; several processors above are in the United States. Where GDPR applies, those transfers rely on the processors' Standard Contractual Clauses and, for US recipients that are certified, the EU–US Data Privacy Framework. Under the DPDP Act, transfers are permitted to any country not restricted by the Central Government.

Your rights

Wherever you are, you can ask me to show you what I hold, correct it, delete it, or stop using it — and I will, without making you justify it. Depending on where you live, these may be formal rights:

• EU/UK (GDPR): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. You may complain to your national supervisory authority.
• India (DPDP Act, 2023): access, correction, erasure, grievance redressal, and nomination. If I do not resolve your grievance, you may approach the Data Protection Board of India.
• California (CCPA/CPRA): know, delete, correct, and opt out of sale or sharing. I do not sell or share personal information, and never have.

To exercise any of these, email shrirangmahajan123@gmail.com. I will respond within 30 days. For cookies specifically, the fastest route is right here: Change my cookie choice.

Security

The site is served over HTTPS and holds no database of its own. That said, no method of transmission over the internet is perfectly secure, and I cannot guarantee absolute security of data in transit to the third-party processors listed above.

Children

This site is not directed at children. I do not knowingly collect personal data from anyone under 18 (the threshold under India's DPDP Act) or under 16 (GDPR). If you believe a child has sent me data through the form, email me and I will delete it.

Changes

If I change this policy materially I will update the date at the top, and — where the change affects cookies — ask for your choice again.

Note. These policies were drafted for a personal, non-commercial portfolio and are written to be accurate about what this specific site actually does. They are not legal advice. If the site ever starts selling something, handling payments, or serving a regulated market, have a qualified lawyer review them first.