---
title: "Privacy — Kevin Canlas"
canonical: "https://www.kevincanlas.com/privacy"
---

# Privacy — Kevin Canlas

A technical description of the analytics, browser preferences, previews, and data requests observable in this site’s current code.

Canonical: [https://www.kevincanlas.com/privacy](https://www.kevincanlas.com/privacy)

## Scope of this page

This is a plain-language description of behavior visible in the current site code. It is not a complete account of how Google, GitHub, Coinbase, X, an email provider, or the hosting provider process information, and it does not make retention, legal-basis, deletion, or availability promises for those services. Their own policies and infrastructure govern the requests they receive.

## Analytics

The site includes Google Analytics through `components/google-analytics-lazy.tsx`. The configured measurement ID is `G-BCSL80T0KW`. The code loads `https://www.googletagmanager.com/gtag/js?id=G-BCSL80T0KW` and initializes `gtag` with that ID using Next.js’s `lazyOnload` strategy, so the request is scheduled after the page has loaded. Loading that script can send page and browser information to Google. This site’s source does not define Google’s retention or processing rules.

## Browser preferences

The color-theme control reads and writes the `kvncnls-color-theme` localStorage key with the values `light` or `dark`. The sound control reads and writes `cuelume-sound-enabled`; the value `false` disables interaction sound and any other stored value leaves sound enabled. These preferences are stored in the browser profile so the selected appearance and sound state can be restored on a later visit. The site’s API handlers do not read these keys or use them as account data.

## Public previews and outside services

The MON market preview requests this site’s `/api/mon-price` endpoint and, while the live preview is active, can open a browser WebSocket to `wss://ws-feed.exchange.coinbase.com` for ticker updates. The site endpoint also fetches public ticker and candle data from Coinbase Exchange. No API key is required by this site’s route.

The GitHub contribution preview requests this site’s `/api/github-contributions` endpoint. That server route reads the public `kvncnls` contribution calendar from GitHub. The social previews for X / Twitter and GitHub use image assets bundled with this site; following their profile links takes you to those third-party services. A third-party service can receive the request when a browser follows an external link or when a server-side preview route reads its public data.

## Hosting and data requests

A request for a page, stylesheet, script, image, video, or API response is handled by the service hosting the deployed site. The current repository has no sign-in, comments, uploads, payment flow, or site-managed user database. The public API routes are read-only and do not require an API key. The site can still receive ordinary request information needed to serve HTTP traffic, such as the requested path and information carried by the request; this page does not claim a retention period for hosting logs.

The market response is sent with `Cache-Control: private, no-store`; the server may keep fetched candle history in memory for up to five minutes while serving that route. The GitHub response uses `public, max-age=0`, an `s-maxage` ending at the next midnight in `America/Toronto`, and `stale-while-revalidate=300`; the server keeps one rolling-year response in memory until that refresh point. These are cache controls, not promises about third-party retention.

The optional API quota feature, when configured, uses a trusted client IP address to derive an HMAC-based pseudonymous counter key in a shared Redis store. The request counter expires with its quota window; the raw IP address is not sent as the counter key. This does not make request metadata anonymous or define the hosting or database provider's logging policies. No quota store is used when the feature is unconfigured. See the [API rate-limit documentation](/developers#rate-limits) for request and caching behavior.

## Limits and requests

This site does not currently expose an account export, correction, deletion, or consent-preference dashboard. If you have a question about this site’s pages or code, use the public address on the [Contact](/contact) page. Requests about analytics, GitHub, Coinbase, X / Twitter, email, or hosting data need to be directed to the service that controls that data. Nothing on this page should be read as a promise that a third party will retain, remove, disclose, or respond to a request in a particular way.