Privacy

Effective 12 October 2026

Who runs this site

kalunchan.dev is the personal site of Ka Lun Chan (KC). It is operated by Yippify, which is responsible for the personal information described here. To reach me about privacy, use the contact form or message me on LinkedIn.

What I collect

When you use the contact form

• Your name, email address, company (optional), the topic you choose, and your message.
• A random ID for that form fill and the time you opened the form. They stop double sends and filter out automated spam.
• A one-way, salted hash of your IP address, used only to limit each visitor to a few messages an hour. Your IP address itself is never stored or emailed.

Your message is emailed to my inbox. It is not kept in a database on this site.

When you read the site

• Page views and page speed, through Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser, and doesn’t identify you.
• Standard request details such as IP address, browser and the page requested, which Cloudflare and Amazon Web Services handle to deliver the site and protect it from abuse.

This site sets no cookies of its own and doesn’t use advertising or cross-site tracking. Cloudflare may set a strictly necessary security cookie if it needs to check that a visitor isn’t a bot.

Why

• To read and reply to your message.
• To keep the form free of spam and abuse.
• To see which pages people read and whether the site loads quickly.

Where the law asks for a legal basis, replying to you rests on your request, and spam protection and anonymous statistics rest on legitimate interests in running a usable, secure site.

Who else handles it

I don’t sell or share personal information, and I don’t use it for advertising. These service providers process it on my behalf:

• Amazon Web Services (United States, Oregon region): runs the contact form, sends the email and keeps the short-lived spam and rate-limit records.
• Cloudflare: delivers the site and provides Web Analytics.
• My email provider: holds the messages you send.

If you write from outside the United States, your message is processed in the United States.

How long I keep it

• Contact messages: up to 24 months after our last exchange, then deleted.
• Rate-limit hashes: expire after two hours, then are deleted automatically.
• Form IDs: expire after 24 hours, then are deleted automatically.
• Contact form logs, which record only the outcome and never what you wrote: 30 days.

Your choices

You can ask what I hold about you, ask me to correct it, or ask me to delete it. Send the request through the contact form or LinkedIn and I’ll answer within 30 days. Depending on where you live (for example the EU, the UK, Canada or California), you may have further rights, including the right to object and to complain to your local data protection authority.

Do Not Track and Global Privacy Control

This site doesn’t track you across other sites and has no advertising cookies, so there is nothing for Do Not Track or Global Privacy Control to switch off. The site behaves the same whether or not your browser sends them.

Children

This site is for professionals and isn’t directed at children under 13. I don’t knowingly collect their information.

Other sites

Links to LinkedIn, GitHub and other sites lead to services with their own privacy policies.

Changes

If these practices change, I’ll update this page and the date at the top.