Privacy
The short version: I collect what you type into the contact form, I use it to reply to you, and I do nothing else with it. The longer version is below, written to be read rather than to be survived.
Who is responsible
Ionuț Sandu, an independent developer based in Bacău, Romania. I am the data controller for anything submitted through this site, and there is no company and no team behind me. There are a few companies whose services the site runs on, because a site has to be hosted somewhere and email has to be sent by someone; they act on my instructions and they are all named below, so you can see the whole list rather than take my word for its length. You can reach me at contact@ionutsandu.dev.
What I collect
From the contact form, only what you type: your name, your email address, the project type and budget range you select, and your message. Nothing is inferred, enriched, or bought from anywhere else. I do not know your company size, your job title or your funding round unless you tell me. Separately from that, the site counts visits in the way described under Analytics below, which involves no cookie and no name.
Why I collect it
To reply to you and, if we work together, to write a scope and agree what is owed. The legal basis is your consent when you press send, and afterwards the legitimate interest of answering someone who asked me a question. It is not used for marketing, because I do not do any.
How long I keep it
Enquiries that don’t become projects are deleted after twelve months. Project correspondence is kept for as long as Romanian bookkeeping law requires, which is currently ten years for anything attached to an invoice. The anonymous visit records described below are deleted after fourteen months, by a job that runs every morning rather than by me remembering to. Nothing is kept indefinitely just in case.
Who else can see it
Four companies, each because the site cannot work without it. Vercel hosts the site and serves every page you have loaded. Neon runs the database your enquiry is stored in. Resend delivers it to my inbox. Expo pushes a notification to my phone carrying your name and one line about the project, so a message does not sit unread for a day while I am building. That is the complete list. Vercel and Neon are involved whether you send anything or not, because one serves the page and the other holds the visit count; Resend and Expo only ever see anything if you press send. No analytics company receives your message, because there is no analytics company. There are no advertising pixels, no session recording, and no third-party chat widget here.
Analytics and cookies
One cookie, and only if you ask for it. Choosing a language with the switch in the header stores that choice, so the site stops guessing on your next visit; nothing else is ever written to your browser. Visits are counted by the site itself rather than by an analytics product, and the record is kept in my own database: which page was opened, in which language, the domain of the site that linked you here, any campaign tag that was on the link, your country, and whether you are on a phone, a tablet or a desktop. Alongside that it notes things done rather than read, such as how far down a page you scrolled and which buttons were pressed. What ties those together is not a name or a cookie but a number worked out from your IP address, your browser's description of itself and a secret, which is thrown away and rebuilt differently every midnight UTC. Your IP address is never stored, the number cannot be turned back into it, and today's cannot be matched to yesterday's, which is why the site can tell you how many people came today and genuinely cannot tell you whether you were here last week. The legal basis is my legitimate interest in knowing whether the site works, and this is the least identifying way I could find of answering that. Vercel Speed Insights separately records how quickly pages render, which is timing about the page rather than anything about you. Sending the contact form adds one line to that same count, saying that a message was sent and never who sent it or what it said; the message itself is stored as described above. Remembering a preference you set yourself needs no permission and nothing here follows you off this site, which is why you have not been asked to accept anything.
Your rights
Under the GDPR you can ask me for a copy of what I hold, ask me to correct it, or ask me to delete it. Email me and I will do it within thirty days, usually the same week. You can also complain to ANSPDCP, the Romanian data protection authority, and you do not need to go through me first.
Changes to this page
If this page changes materially I will update the date at the top. There is no mailing list to notify, because I don’t run one.