Privacy notice
This site is a personal portfolio operated by Dohoon Cho. Most of its pages are visible only to people who hold a per-recipient access key that I have issued to them by email or another personal channel.
What is logged
When you open a gated page (any project marked private), the server stores a single row containing:
- the recipient identifier tied to your access key,
- the page slug,
- a timestamp (UTC, second precision),
- a one-way HMAC of your IP address - not the IP itself,
- your country code (from Cloudflare's
CF-IPCountryheader), - your city, when Cloudflare can derive it from your IP,
- your
User-Agentstring, truncated to 256 characters, - the HTTP
Refererheader if present, truncated to 256 characters.
This audit trail covers gated pages only. Engagement across all pages (including the landing page and this notice) is covered separately by Site analytics below.
Site analytics
To understand which parts of the portfolio resonate, the site measures
engagement on every page: the pages you view and their order, how long a
page is actually in the foreground, how far you scroll, which deck slides
you dwell on, clicks on outbound links, and any
utm_*
campaign tags on the link you arrived through. Each event is stored with
the same non-identifying fields as above (hashed IP, country/city,
User-Agent).
How this is tied to who you are depends on your status:
- Signed-in recipients are asked once
for consent. Choose Allow and events are linked to your recipient
identity, with a first-party
__Host-pf_ascookie grouping your visit. Choose No thanks and no cookie is set; you are treated as anonymous. - Everyone else (anonymous visitors,
and recipients who declined) is measured without any cookie. Visits are
grouped only by a short-lived key the server derives from the hashed IP
and
User-Agent; it cannot identify you and rotates every 30 minutes.
If your browser sends a Global Privacy Control signal, the site collects nothing at all.
Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
| __Host-pf_session | Keeps you signed in after you enter an access key. Essential; set only for recipients. | Up to the token life |
| __Host-pf_as | Groups your visit for site analytics. Set only after a signed-in recipient chooses Allow. | 30 minutes (rolling) |
| pf_oauth | Transient state for "Continue with Google" sign-in. | 10 minutes |
Retention
Access events and analytics events are kept for up to 12 months and then deleted. Recipient records (name, email, company, notes that you sent me) are kept for as long as the access remains useful; on request I will delete them sooner.
Where the data lives
The site is hosted on Cloudflare infrastructure in the United States.
Your requests
To request deletion of your records, to revoke your access key, or to ask any question about what is logged, email [email protected]. I will respond within 10 days.
Korean residents (PIPA)
If you are a resident of South Korea, the personal information controller is Dohoon Cho ([email protected]). The categories described above (the gated-access audit fields, the site analytics events, and the recipient records you sent me) are the entirety of personal data collected. A Korean-language version of this notice is available on request.