Privacy

I am the responsible party: Andy Lim Chou Sang, Pretoria, South Africa. I am also the Information Officer. Questions, requests and complaints about personal information go to andy@limchousang.com.

I use information for four purposes: to present my work, to respond when someone gets in touch or asks for access to my private work, to give approved people a time-limited link to that work, and to protect the site from misuse. Giving me information is voluntary. You can read the whole site without sending me anything.

I use Vercel Web Analytics and Vercel Speed Insights to see how many people visit and how fast pages load. They are cookieless and report aggregate figures only. They do not build a profile of you.

The hosting provider, Vercel, keeps standard server logs of requests to the site (for example the page requested, the time and the IP address). I use these only to keep the site running and secure. They are kept by Vercel under its own retention terms.

There is no general contact form. If you email andy@limchousang.com, I receive your email address and whatever you choose to write. The address forwards through an email-forwarding service to a personal mailbox (Gmail). I use your email only to reply to you.

Some links to this site are made for a specific application. For each one I store its label, the date it was created, how many times it has been opened and when it was last opened. I do not store who opened it. A link can also be set to unlock my private work for a limited time. When you open such a link and click through, a secure cookie is set in your browser so the private work can show. It lasts no longer than 24 hours or the link's end date, whichever is sooner, and I can switch the link off at any time.

You can ask for access to my private work with the request form. It collects your name and email address and, if you choose to give them, your organisation or role and a short message. I use these only to respond to your request and, if I approve it, to send you a time-limited link. By ticking the box on the form you agree to that use, and you can withdraw your consent at any time by emailing me. I keep a request for up to 12 months and then it is deleted automatically, or sooner if you ask me to delete it. Google (Gmail) delivers the notification to me and my reply to you; those emails sit in my mailbox and I delete them when I delete the request. The form also records a one-way hash of your IP address, not the address itself, to limit abuse.

Private work is only shown to people I have approved or sent a link, and the admin area needs a sign-in. To slow down guessing at the sign-in and at private links, the server counts failed attempts. It keeps each count against a one-way hash of the IP address, so the address itself is not stored and the hash cannot be turned back into it. I also keep a security log of events such as failed and successful sign-ins against the same hash. Counts are cleared within 24 hours and the log is kept for 90 days at most.

The site saves a few small items in your browser. None of them are sent to me or used to track you.

• Your light or dark theme choice, in local storage.
• A secure cookie that unlocks private work when you open a link that includes private work. It lasts 24 hours, or until the link's end date if that comes sooner, and a small marker cookie with no personal information tells this site to check it.
• A flag that the intro has played, in session storage. It clears when you close the tab.

There is no advertising and no third-party tracking on this site. I do not profile visitors, I do not sell information and I do not share it for marketing.

These operators process information for me under their own terms. Some of them are outside South Africa, so information may be processed outside South Africa.

• Vercel, Inc. (United States): hosting, server logs, Web Analytics, Speed Insights and private storage for the security records, tracked links and access requests.
• Google (United States): Gmail for the mailbox that receives forwarded enquiries and access-request notifications and that sends my replies and approval emails, and Search Console for how the site appears in search.
• An email-forwarding service: passes mail sent to andy@limchousang.com on to my mailbox.
• Afrihost (South Africa): the domain name and its DNS records.

I keep information only as long as it is needed.

• Enquiry emails: as long as needed to respond, and no longer than 24 months.
• Tracked application links: until I delete them.
• Access requests: up to 12 months, then deleted automatically, or earlier if you ask.
• Failed-attempt counts: cleared within 24 hours.
• Security log: 90 days at most.
• Server logs and analytics: as set by Vercel under its own terms.

The site is served over an encrypted connection. Access to the admin area is limited to me, behind a sign-in that locks after repeated wrong attempts. Sensitive records are kept in private storage, not public storage. Identifiers in the security records are hashed. Repeated wrong attempts at the sign-in and at private links are limited.

Signing in to the admin area sets a secure session cookie that lasts 12 hours. It is for my use only and is never set for visitors. While I am signed in, a small marker cookie with no personal information also lets the public site show me my private work.

Under POPIA you can ask me to confirm whether I hold information about you and to give you a copy, to correct it, to delete it, and to stop using it (objection). Where I rely on your consent you can withdraw it. Email andy@limchousang.com to make a request. I will respond within 30 days.

If you are not happy with how I have handled your information, please tell me first. You also have the right to complain to the Information Regulator (South Africa) at inforegulator.org.za, or by email to complaints.IR@inforegulator.org.za.

Information Regulator (South Africa)

If you think you have found a weakness in this site, please email me. Details for security researchers are in the security.txt file.

security.txt

For questions, or to ask me to delete anything, write to andy@limchousang.com.