Privacy Policy
How this site handles data — in plain language, not boilerplate.
Last updated: 5 September 2026
The short version. This site sets no cookies and asks for no login. Analytics are configured to store nothing on your device, so there is no consent banner to dismiss. The only personal data I ever receive is what you type into the contact form yourself.
1. Who runs this site
This is the personal portfolio of Bashar Shaikhani, an independent full-stack developer, project leader, and UI/UX & graphic designer based in Damascus, Syria. I am the controller of any personal data described below.
- Email: basharshaikhani@gmail.com
- Site: eng-bashar.com
I work with clients worldwide, so everything described here applies to every visitor equally, wherever you are — I do not keep a weaker standard for regions with weaker laws. Where a data protection law such as the GDPR (EU, UK, EEA), the Swiss FADP, Brazil's LGPD, Canada's PIPEDA or Saudi Arabia's PDPL also covers you, it gives you enforceable rights on top of that; those are set out in section 6.
2. Analytics — Google Analytics 4, without cookies
I use Google Analytics 4 to understand how many people visit, which countries they come from, which projects they open, and how often the CV is downloaded. It runs in a deliberately reduced configuration:
- No cookies and no local storage. Analytics runs with
client_storage: 'none', so nothing is written to your device and nothing is read from it. This is why you are not asked to accept anything. - No cross-site advertising signals. Google Signals and ad personalisation are switched off, so this data is never used to target ads at you.
- No IP address is stored. Google Analytics 4 uses your IP only to derive an approximate country, then discards it.
- You are not recognised between visits. Because nothing is stored, each page view is counted independently. I cannot tell that two visits came from the same person.
What is processed: the page you viewed, approximate country, referring site, and general device and browser type. Google acts as my processor and may process this in the United States under the EU–US Data Privacy Framework.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding whether the site works and reaches anyone — balanced against the fact that no identifier is stored and no profile can be built.
If you would rather not be counted at all, any content blocker or your browser's “Do Not Track” setting will stop it, and nothing on the site will break.
3. The contact form
If you message me through the contact form, the name, email address and message you type are sent to me through Formspree, which delivers them to my inbox. I use them to reply to you and for nothing else — no newsletter, no marketing, no sharing or selling.
Legal basis: your request, and steps taken at your request before any working relationship (Art. 6(1)(b) GDPR). I keep correspondence only as long as the conversation and any resulting work require it.
4. Hosting
The site is hosted on Cloudflare Pages. Like every web host, Cloudflare processes connection data such as IP addresses in order to serve pages and to protect the site from attacks and abuse. This happens at the network level, before any page code runs, and is necessary for the site to work at all (Art. 6(1)(f) GDPR).
5. What this site does not do
- No advertising cookies, tracking pixels or social media trackers.
- No accounts, passwords or payment details.
- No selling or sharing of data with third parties for their own purposes.
- No profiling and no automated decision-making.
6. Your rights
Whoever and wherever you are, you can ask me for access to any data I hold about you, ask me to correct it, or ask me to delete it — I will not ask which country you are writing from before acting on that.
If a law such as the GDPR covers you, those requests are enforceable rights rather than a courtesy, and they come with more: restriction of processing, a copy in portable form, the right to object to processing based on legitimate interest, and the right to lodge a complaint with your national data protection authority.
In practice, the only data I hold that could identify you is an email you sent me yourself — so a request usually just means asking me to delete our correspondence. Write to basharshaikhani@gmail.com and I will respond within 30 days.
7. Changes
If I change how this site handles data, I will update this page and the date at the top. There is no mailing list to notify, because I do not keep one.