This policy explains what gfgconcepcion.com (the "site") collects about visitors, why, who processes it on the site's behalf, how long it is kept, and what choices you have. It is written for Singapore's Personal Data Protection Act 2012 (PDPA) and is meant to be compatible with the EU and UK General Data Protection Regulation (GDPR).

1. Who runs this site

The site is a personal website run by Gabe, its author, who lives in Singapore and decides what is collected and why (the "organisation" under the PDPA and the "controller" under the GDPR).

To contact the author about this policy or your personal data, use the removal request form described in section 6 and under Contact.

2. Summary

• The site has no accounts, no sign-in, no comments and no newsletter.
• Google Analytics runs only if you click Accept on the cookie banner. If you click Decline, or make no choice, it does not load.
• Your cookie choice is saved in your own browser, not sent to the site.
• Two tools send what you type to Google Cloud to do their job (section 5). They do not ask for, or store, who you are.
• The removal request form (section 6) collects your email address, a webpage URL and your reason.

3. Cookies, browser storage and how to withdraw consent

Your cookie choice. When you click Accept or Decline, the site saves the value granted or denied under the key cookie_consent in your browser's local storage, so the banner does not ask again on every page. It stays in your browser until you clear the site's data. The site never reads it from your browser into any server.

Google Analytics cookies. Only after you click Accept does the site load Google Analytics (measurement ID G-FWZ5YDVF9H). Google Analytics then sets first-party cookies named _ga and _ga_<ID>, which hold a randomly generated identifier. Google sets how long they last; by default it is 2 years.

Withdrawing consent. Click Cookie settings at the bottom of any page and choose Decline. The site then stops Google Analytics on that page, deletes the _ga, _gid and _ga_* cookies it can reach, and does not load Google Analytics again. You can also clear this site's cookies and storage in your browser settings. Withdrawing consent does not affect data already sent to Google Analytics before you withdrew it.

4. Google Analytics

What. Once you accept, Google Analytics receives the pages you view and when, how you arrived (the referring page), your browser, device and screen type, your language, and an approximate location that Google derives from your IP address, linked to the random identifier in the cookies above.

Why. To understand how many people visit, which pages they read and how they find the site, so the author can decide what to write and fix next. The site shows no advertising and does not use this data for advertising.

Basis. Your consent (PDPA consent obligation; GDPR Article 6(1)(a)).

How long. For the data retention period set in the site's Google Analytics property, which Google Analytics limits to at most 14 months.

5. Hosting, tools and resources from other services

Website hosting. The site is served by Firebase Hosting (Google Cloud), over HTTPS. As with any website, delivering a page means Google receives your IP address, browser user agent, the page requested and the referring page. The author does not export these hosting request logs to the site's Google Cloud project, so the author keeps none of them.

Fonts. Pages load the Outfit font from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), so Google receives your IP address and browser user agent when a page loads.

Scripts from jsDelivr. The "Copy as image" buttons load the html2canvas library from cdn.jsdelivr.net the first time you use one. jsDelivr then receives your IP address and browser user agent.

Compliant Community Comments (/apps/compliant_community_comments). What you type (a YouTube video link, account link or @handle) is sent to a Google Cloud Function in the asia-southeast1 (Singapore) region. It uses only that link to look up public information about the YouTube accounts concerned, with Google's YouTube Data API, Web Risk and Cloud Vision, and public domain registration (RDAP) services. Nothing that identifies you is stored: the result is saved in Google Cloud Firestore under the video or account analysed, and reused for 24 hours for anyone who asks about the same video or account. If you click to request a deeper review, the video or account link and the time of the request are stored, and the author is sent an email with that link. The function's own log line for each request records only the step, the result status and the time taken, not your IP address or what you typed, and Google Cloud's automatic request logs (which would hold your IP address) are switched off for it.

Reading Mate (/tools/reading_mate). Text you paste is sent to Google Cloud Text-to-Speech to make an audio file, which is returned to your browser. The tool does not store the text or the audio. Google Cloud Run keeps automatic request logs for it, which include your IP address and browser user agent, and deletes them after 30 days.

Links and share buttons. Links to other websites, and the Threads and X share buttons, take you to those services; their own privacy policies apply once you are there. The site does not embed their content.

6. Removal request form

To request removal of information about you and/or your organization, or information originating from you and/or your organization, use the removal request form (link).

• What is collected. Three required fields: your email address, the webpage URL and the rationale for the removal request.
• Why. To review your request and follow it accordingly. As part of the review, an email seeking additional information may be sent to the email address you provide.
• Basis. Your consent when you submit the form, and the author's legitimate interest in handling removal requests (GDPR Article 6(1)(a) and (f)).
• Where it is stored. In Google Forms and Google Sheets in the author's Google account. Google acts as the author's service provider.
• Who can see it. Only the author.
• How long. Deleted within 12 months from when the request was submitted.
• Sign-in. No Google account sign-in is needed to use the form.
• Earlier deletion. To have your request's details deleted sooner, reply to the author's email or submit another request through the form.

7. Information about people shown on the site

Some pages show information about people and organisations taken from public sources, such as job listings, event listings, public YouTube accounts and analyst coverage. If information about you or your organisation is shown, you can ask for it to be removed with the removal request form (section 6).

8. Who receives data

The site does not sell personal data or share it with anyone other than the service providers named in this policy, which process it on the site's behalf or as described in their own terms:

• Google: Google Analytics, Google Forms and Google Sheets, Google Fonts, and Google Cloud (Firebase Hosting, Cloud Functions, Cloud Run, Firestore, Cloud Logging, YouTube Data API, Web Risk, Cloud Vision, Text-to-Speech, and Gmail for the author's alerts). See Google's privacy policy.
• jsDelivr: the script CDN in section 5.

Transfers outside Singapore and the EU/UK. These providers may process data in other countries, including the United States. The site relies on the providers' own data protection terms for these transfers.

9. How long data is kept

• Cookie choice (cookie_consent): in your browser until you clear it.
• Google Analytics data: the property's retention period, at most 14 months.
• Removal requests: deleted within 12 months from when the request was submitted.
• Compliant Community Comments results and review requests: they hold no data about the person who asked; results are used for 24 hours.
• Reading Mate's request logs: 30 days. Hosting request logs: none kept by the author.

10. Your rights

Under the PDPA you can ask for access to and correction of your personal data, and withdraw consent you have given. Under the GDPR you can also ask for erasure, restriction or a copy of your data, and object to processing based on legitimate interests. To make a request, use the removal request form (section 6). If you are not satisfied with the response, you can complain to Singapore's Personal Data Protection Commission or, under the GDPR, to the data protection authority where you live. Requests are answered as soon as reasonably possible and within one month (never more than 30 days). If more time is needed, you are told within that period why and when you will get an answer.

11. Changes to this policy

When this policy changes, the date at the top changes with it.

12. Contact

For any question or request about this policy or your personal data, use the removal request form (link) and describe your question in its rationale field. The form is the only contact for privacy questions.