Privacy policy

This is a personal portfolio site. It has no analytics, no advertising and no tracking pixels. The personal information it handles is what you choose to type into the contact form, the URL you submit to the website audit tool, the details from LinkedIn if you choose to sign in, and the ordinary server logs any website produces. Signing in is entirely optional; the whole site works without it. Nothing is sold or shared for marketing.

purphoros.com is run by Benjamin C. Tehan, trading through Devforge Pty Ltd, in Victoria, Australia. Questions about this policy or your information go through the contact form.

Server logs

Like any web server, the one behind this site records each request: the page or file asked for, the time, your IP address, and your browser's user agent string. These logs exist to keep the site running, to spot abuse, and to debug faults. They are not used to build a profile of you and are not combined with anything else.

Cookies and browser storage

Two cookies and two browser storage entries, all first-party, none used for tracking:

There is no cookie banner because none of these are used for analytics or advertising, and the site works without them: clear them and you lose your theme choice and see the hints again, nothing more.

The contact form

If you send a message, the form collects your name, your email address, the topic you pick and the message itself. That is emailed to me through Resend, an email delivery service, and lands in my mailbox. It is not written to a database on this site. The form has a hidden honeypot field to catch bots; a real browser never fills it in. I keep contact emails for as long as the conversation is useful and delete them on request.

The website audit tool

When you audit a site, the URL you submit is fetched by this server, which then checks the page, its robots.txt, sitemap and llms.txt, its TLS certificate, and its DNS and domain records. Three things follow from that:

• The site you audit sees requests from this server, identified by a user agent that names the tool. Only audit sites you own or are authorised to test.
• Your IP address is held in memory for up to a minute to limit how many audits and PDF downloads one address can run. It is not written to disk.
• The report is generated on demand, returned to your browser, and not stored. The PDF is built from the report you send back and is likewise not kept. Preview images in the report are fetched through a small proxy and may be cached for ten minutes.

Sign in with LinkedIn

Signing in is optional and exists so you can hold an account against Anvil DB, the graph database I build. If you choose it, LinkedIn asks you to authorise sharing your name and email address, then sends you back here. What follows:

• The account is created and stored in Anvil DB, run by Devforge Pty Ltd, not on this portfolio site. It holds your name, email, a username derived from your email, and your role in the app.
• This site never sees your LinkedIn password. The sign-in happens between your browser, LinkedIn and the Anvil server.
• After sign-in your browser keeps sign-in tokens (JWTs) in its local storage under the key "tehan_anvil_tokens", so you stay signed in and the site can show your name. They are read by your browser only and are never sent to this site's own server.
• Your name and email from the token are shown on the profile page and as the account name in the header while you are signed in.
• Signing out clears those tokens from your browser. The account itself remains in Anvil until deleted; ask through the contact form to have it removed.

The calendar and other pages

The calendar page shows my own commit history. Every other page is static content about me. None of them collect anything beyond the server logs above.

• Resend delivers contact-form email. It processes the message and your address for that purpose only.
• LinkedIn, if you choose to sign in: it authenticates you and shares your name and email under its own privacy policy. Nothing goes to LinkedIn unless you start the sign-in yourself.
• Anvil DB, run by Devforge Pty Ltd, holds the account created when you sign in (name, email, username, role). It is my own service, not a third-party marketer.
• Music pages embed YouTube's player. When a video loads, YouTube and Google may set their own cookies and receive your IP address, under Google's privacy policy. Nothing loads from YouTube until you visit a page with a player on it.
• Links to GitHub, LinkedIn, Spotify, Apple Music, SoundCloud and other sites take you to those services, which have their own policies.
• The site is served from hosting infrastructure that keeps standard access logs as described above.

Fonts are served from this site, not from a third party, and no analytics, advertising or social-media scripts are loaded.

• Server logs: kept for operational purposes and rotated in the ordinary course.
• Contact messages: kept in my mailbox while the conversation is useful, deleted on request.
• Audit submissions and reports: not stored. Rate-limit records expire within a minute.
• Cookies: dark_mode expires after a year, _csrf after 24 hours.
• Sign-in account: kept in Anvil DB until you ask for it to be deleted. The tokens in your browser clear when you sign out.

You can use every page without cookies, browser storage or signing in. If you did sign in, you can sign out to clear the tokens from your browser at any time. You can ask what information I hold about you, ask for it to be corrected, or ask for it to be deleted, and I will do that for anything within my control, which means contact emails and any account you created by signing in. Send those requests through the contact form. If you are in Australia and are not satisfied with my response, you can complain to the Office of the Australian Information Commissioner.

The site is served over HTTPS with a content security policy, forms are protected by the CSRF token above, and the audit tool refuses to fetch private or internal network addresses. Because the site keeps no database of visitor information, there is very little to lose.

This site is not directed at children and does not knowingly collect information from anyone under 16.

If the site starts collecting something new, this page changes in the same release and the date at the top moves. The history of this page is in the site's source repository.