Privacy
A clear view of what happens when you visit or start a conversation.
Updated October 2026
Browsing: No account needed.
Your choice: Optional analytics.
Your information: Nothing sold.
Browsing the portfolio
You can browse without an account. When a page is served, the server and the analytics tools below may record your IP address, an approximate location derived from it, your browser and device type, a session identifier, and the pages you view and how long you stay.
This is used to understand how visitors move through the work and to improve it. Nothing here is used for advertising, and nothing is sold, rented, or traded.
Cookies and preferences
Your choice is stored in this browser so you are not asked again. Usage analytics and session replay are optional, and off until you allow them. You can change your choice at any time from Cookie settings at the top of this page.
If I send you a review link, opening it marks this browser with a token so that your visit is counted as a test and kept out of the figures. The visit is still recorded, and nothing else about it changes.
Conversations with the assistant
When you send a message, your question and the recent conversation are sent to my AI service, which is built on Anthropic’s Claude. The text of the exchange, your IP address and approximate location, a timestamp, your device type, and the referring page are logged to a database on a private server that I control, and kept for up to 12 months to understand what visitors ask. Please avoid sharing sensitive personal information.
In voice mode, speech is transcribed by your browser’s speech recognition. Depending on the browser, that may happen on your device or through the browser maker’s own speech service (Chrome, for example, sends audio to Google to transcribe). My server only ever receives the transcribed text, never the audio. Spoken replies are generated by ElevenLabs from the text of the answer alone.
Analytics
Google Analytics 4 collects anonymized usage data such as page views, session length, and traffic sources. FullStory records anonymized session replays to find usability problems. A first-party, cookieless script on my own server notes page views, time engaged, scroll depth, rage and dead clicks, and which kind of link was used (email, download, outbound); it never records an address or anything typed. All three load only with your consent.
Experiments
Now and then the site shows two versions of one small thing, such as a line of text or the order of the featured work, to learn which one serves visitors better. Which version you see is decided on my server from a one-way hash of your IP address and browser type, made with a secret that belongs to that one experiment and is thrown away when the experiment ends. The server counts that a version was shown and whether the visitor went on to another page, opened the assistant, or followed a contact link. Nothing is stored in your browser for this, the hash cannot be turned back into an address, and the counts are never joined to your conversations or sold.
If you have declined optional analytics, you always see the site as it is and are never counted.
Speed
To keep the site fast, your browser reports how each page behaved: how long it took to appear, whether anything on it jumped, and how quickly it answered a tap or click. These timings are sent to my server with the page you were on, whether the screen was a phone or a desktop, the kind of browser, and the name of the part of the page that moved, if one did. No IP address is kept with them, nothing is stored in your browser, and nothing you type or read is included. To count visits and to stop abuse, each record carries a one-way hash of your IP address and browser type, made with a secret that is replaced every day, so it cannot be turned back into an address or followed from one day to the next. Records are kept for up to 12 months.
If you have declined optional analytics, nothing is sent.
Who’s here
When someone else is on the same page at the same time, you’ll see their pointer and the city their connection comes from, and they’ll see yours. Press / to say something short; it shows for five seconds and is never kept. Only where your pointer is and what you choose to say are shared, through a small Cloudflare service that keeps nothing once you leave. If you decline analytics, you’re never shown.
Your rights
In the European Union, under the GDPR, you can ask to access, correct, erase, restrict, object to, or receive a copy of the personal data held about you. In California, under the CCPA, you can ask what is collected, request deletion, and opt out of any sale of your information. No personal information is sold.
To exercise any of these, write to andrew@andrewreff.com.
Services and retention
Google Analytics (Google LLC), FullStory (FullStory Inc.), the Anthropic API (Anthropic PBC, only when you use the assistant), ElevenLabs (ElevenLabs Inc., only in voice mode), and Sanity (Sanity AS, which holds the site’s content) each process data under their own policies. Conversation logs are deleted after 12 months; analytics retention follows each provider’s settings.
Children
This site is not directed at children under 13, and no data is knowingly collected from them. If you believe a child has shared something here, write and it will be deleted.
Changes and contact
If how this site handles data changes, this page and the date at the top change with it. Questions or requests: andrew@andrewreff.com.
andrewreff.com