Privacy

This page describes the site's settings as checked on 2026-10-11. Session replay is off on this page.

What is collected

Two analytics tools, PostHog and Google Analytics 4, run on every page unless you turn them off here, your browser sends Global Privacy Control, or JavaScript is off. On the one page with video, Mux Data, Mux's playback analytics, follows the same setting. Cloudflare's own web analytics can run as well, depending on its settings and only where JavaScript runs, and the controls above do not reach it. This section says what each one receives.

PostHog

• Page views and clicks, including the clicked element's tag, classes, link address, and visible text. Mouse movement and clicks are also recorded for heatmaps.
• Page performance measurements and JavaScript errors the page raises.
• Session replay: a recording of the page as you saw it, with its text and layout, your mouse movement, scrolling, and clicks. Anything you type is masked before it is recorded. Replay does not record the browser console, the contents of canvas elements, or the network requests the page makes.
• A random visitor ID, device ID, and session ID. PostHog keeps them in a first-party cookie that lasts 365 days and in your browser's local storage, and it creates a profile for every visitor.
• Your browser, operating system, device type, language, time zone, screen and window size, and the full user-agent string.
• The page's address and the page that referred you, reduced to the site's origin and path plus campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, and utm_content). Other query parameters, click identifiers such as gclid and fbclid included, and fragments are removed before sending. PostHog does still record two campaign values from the address, gad_source and mc_cid, as their own properties when the address carries them.
• Your country, region, city, postal code, approximate latitude and longitude, and time zone, which PostHog derives from your IP address when an event arrives. PostHog then discards the IP address instead of storing it with the event.
• Named events for actions on this site: for example, which homepage panel you opened, which project or post you viewed, and whether you downloaded the résumé. None carries anything you typed.

Google Analytics 4

• Page views and scroll depth, and, on the homepage, which panels you hover over with a mouse. Google Analytics' automatic tracking of clicks on links that leave the site, file downloads, form interactions, video, and site searches is turned off.
• The page's address and referrer, reduced the same way as for PostHog, the page title, your language, screen resolution, and User-Agent Client Hints describing your browser, operating system, and device model.
• A client ID and session ID, kept in first-party cookies named _ga and _ga_ followed by the property ID. Google documents a two-year lifetime that refreshes on each visit; Chrome caps each write at 400 days.
• User-provided data collection is off, so Google's tag does not look for email addresses, phone numbers, or street addresses. Google signals, which would add data from visitors' Google accounts, is also off.
• Google states that it derives your city, region, and country from your IP address.

Cloudflare Web Analytics

Cloudflare inserts its Web Analytics script into pages at its edge. Its settings can exclude some visitors, such as those in the EU, and which setting applies here has not been verified. It is not part of this site's code, and the controls on this page do not affect it. After a page loads, the script sends Cloudflare page-load timings, a page-load ID, the page's origin and path without query string or fragment, and your browser, operating system, and device type; it sends a second request when you leave the page. Cloudflare documents that the script also reports the address of the page you came from. Cloudflare states that it sets no cookies or local storage, does not fingerprint visitors by IP address or user agent, and discards the IP address it receives at the nearest data center.

Cloudflare's Network Error Logging is turned off for this site. A browser that stored the site's earlier logging policy can still report a failed request to Cloudflare until that policy expires; such a report carries the failed address without its fragment, the referring page, and connection details. On pages that show an email address, Cloudflare inserts a small script that decodes the address in the browser; no data was observed leaving the page from it.

Who receives it

• PostHog receives everything in the PostHog list above. Its requests go through d.nathanpayne.com, a reverse proxy PostHog manages and routes through Cloudflare, which PostHog lists as a subprocessor.
• Google receives everything in the Google Analytics list above, at www.google-analytics.com. Your browser loads Google's tag from www.googletagmanager.com, and on a small share of page loads the tag also sends diagnostic reports there, with the page's host and path and counts of the requests it made. The Google Analytics property is not linked to Google Ads or any other advertising product, and its setting that shares data with Google to improve Google's products and services is off. Its settings let Google use the data for modeling and benchmarking, which Google states it aggregates and de-identifies first, let Google's support staff access the account to solve problems, and let Google use account data to make recommendations.
• Cloudflare serves this site and receives every request for a page or file: your IP address, the address requested including any query string, your browser's user agent, and the referring page. It also receives the Web Analytics and error reports described above.
• Firebase Hosting (Google) hosts the site behind Cloudflare and receives the same request details for the requests Cloudflare does not answer from its cache.
• Logo.dev, on the résumé page only, serves employer and school logos and receives the same, plus the name of each organization being looked up.
• Mux, on the Swipe Watch project page only, streams that page's video and receives your IP address, user agent, and this site's origin as the referrer. Mux Data, its playback analytics, runs only when analytics are on, and sends nothing when your browser sends Do Not Track. Otherwise it receives viewer and playback data, with the page address reduced the same way as for PostHog, and it sets no cookie. Mux states that it derives your country and state from your IP address and then keeps only the first three parts of an IPv4 address.
• GitHub: when PostHog's error tracking detects a new error on the site, an automation files an issue in this site's public GitHub repository. The issue names the type of error and links to it in PostHog. It does not copy the error message, and it carries no visitor ID.

Why I collect it

I use these tools to see which pages and links get used, to find errors and layout bugs (both kinds of alert file issues automatically so I notice them), and to watch how pages behave for real visitors so I can fix what breaks. Session replay exists for that last purpose.

How long it is kept

• PostHog session recordings: 30 days.
• PostHog events: PostHog lists 7-year data retention for the plan this site uses.
• Google Analytics: event data 2 months; user data 14 months, counted again from each return visit.
• PostHog's identifiers: the cookie lasts 365 days; the same identifiers are also kept in your browser's local storage, which lasts until you clear it, and in session storage for as long as the tab is open. Google Analytics cookies: Google documents two years, refreshed on each visit, and Chrome caps each write at 400 days.
• Cloudflare Web Analytics: Cloudflare states that it keeps raw data for 7 days and then a sample of about 10% for longer-term reporting.
• Mux Data playback data: up to 100 days, per Mux.
• Error-alert issues on GitHub: until the issue is deleted; PostHog's retention does not reach them.
• Firebase Hosting request logs, if exported to Cloud Logging: 30 days by default, per Firebase.
• Other retention periods (PostHog visitor profiles and Cloudflare's own logs) are set in each vendor's account, were not verified, and are not stated here.

Global Privacy Control

Global Privacy Control is a signal a browser or extension can send to ask sites to opt you out. This site honors it: when your browser sends it, PostHog, Google Analytics, and Mux Data are off whatever you chose here, and the "Turn analytics on" button above is unavailable. If you turn analytics off here and your browser saves that choice, they stay off after your browser stops sending the signal. The signal does not reach Cloudflare's analytics or the other services listed above.

What turning analytics off does not do

• It does not delete anything already sent. Events, recordings, and the profile PostHog created stay with each vendor under its own retention. A request already on its way at the moment you click may still complete.
• It does not remove the cookies and storage entries the tools set earlier. They stay until they expire or you clear them; turning analytics off stops their use, not their existence.
• It does not reach Cloudflare Web Analytics, the Cloudflare and Firebase servers that serve the site, Logo.dev, or Mux's video streaming. It does stop Mux Data.
• Your choice is kept in your browser's local storage under the key np-privacy. No cookie is set for it, and it is not sent to a server. Turning analytics back on takes effect on the next page you load, provided your browser saves the choice; if it cannot, your earlier setting still applies.

Contact

Questions about this page or about these tools: email me.