Who is responsible?
Ayo Najah is responsible for the information collected through this website. For questions or privacy requests, email Ayo.
Visitor location and IP address
When you open this site, your browser automatically contacts ipapi.is to estimate your city and country from your public IP address. This supplies the location and country flag shown in the header; your IP address is not displayed. A lookup may also run when your connection is restored or you choose Retry.
The provider receives your full public IP address and normal connection information. Not displaying the address on this page does not make it anonymous to the provider. The lookup does not request GPS access, send your contact-form details, or intentionally send cookies or the referring page.
The result is kept in this page’s browser memory, not saved as a visitor record by the application. Your location is approximate; a VPN, proxy or mobile network may show a different city or country. Blocking the lookup does not prevent browsing the site. The online indicator uses your browser’s connection status.
Contact messages
If you submit the contact form, your name, email address and message are sent to Supabase and stored in the website’s contact-message database so your enquiry can be handled. Please do not include passwords, payment details or other sensitive information.
If you use an email link instead, the message is sent through your email service and the recipient’s email service. Opening an email link alone does not submit a message through the website form.
Browser storage and cookies
The site uses local storage in your browser to remember your light or dark theme preference. It remains until you change it or clear this site’s browser data. If no preference is saved, the site uses your device’s colour-scheme setting.
The cookie banner lets you accept or reject optional analytics. The necessary ayo_analytics_consent_v2 cookie remembers your choice for 180 days. After acceptance, ayo_returning_visitor is an optional 180-day cookie indicating a previous consented visit; it contains no name, email or unique visitor identifier.
Analytics uses Replit’s Umami tracker, when enabled in publishing, to measure page views, returning visits, resume opens/downloads, email and LinkedIn link clicks, and Life/Studies chapter selections. Custom events contain only action labels and chapter or resume names—not contact details, form messages or precise locations. With consent, a separate private Supabase activity log stores the full request IP address, page path, timestamp and action. Your IP is taken from the hosting proxy, not from the visible location label. The analytics service still receives normal network information needed for delivery. There is no advertising or cross-site tracking in the application.
The tracker’s umami.disabled local-storage opt-out is set before acceptance and after rejection. Session storage prevents duplicate visit events within a tab session. Use Cookie settings in the footer to withdraw consent at any time; rejecting removes the returning-visitor cookie and stops future analytics. It does not erase data already collected. Hosting logs and the IP-based location lookup are separate from optional analytics.
Hosting and other services
- Replit: hosts the website. Hosting infrastructure processes technical request information, which can include IP addresses and request logs, to deliver, monitor and secure the site.
- Google Fonts: supplies the site’s typefaces. Your browser contacts Google’s font servers, which receive your IP address and connection information.
- ipapi.is: provides the IP-based location lookup described above.
- Supabase: provides the database used to receive contact-form messages and separate private security and consented activity logs. Log tables are not accessible through the public website.
These providers may process information outside your country, including outside the European Economic Area. Their privacy terms explain their processing, retention and applicable transfer safeguards. External links, such as LinkedIn, take you to services with their own privacy practices.
How long information is kept
Application security logs record full request IP addresses, timestamps, sanitized page paths, request methods and response status codes. These are separate from optional analytics and are used to protect and troubleshoot the site on the basis of legitimate interests. They do not include request bodies, cookies, tokens, passwords or contact messages. VPN and proxy visitors remain allowed.
Private security and consented activity records expire six calendar months after collection. The database cleanup runs monthly at 03:00 UTC on the 1st, so records are deleted within seven months of collection. This schedule must be enabled through the database logging migration. Withdrawing analytics consent stops new activity records, but does not delete existing records or stop necessary security logging. Static assets served outside the application server may appear only in the hosting provider’s own logs.
The location lookup result is discarded when the page session ends. Theme preferences remain in your browser until changed or cleared. Contact messages remain in the database until removed; the application currently has no automatic deletion schedule. You can request removal using the email address above.
Retention of hosting logs, provider records and email correspondence is separate from browser memory. This website does not control service providers’ independent retention periods.
Your choices and rights
You can clear saved browser preferences, block third-party requests through your browser, and choose not to submit the contact form. The location lookup currently happens automatically; there is no separate on-site opt-in setting.
Where applicable under data-protection law, you can request access to, correction or deletion of your personal data, object to processing, or ask for restriction or portability. Email the address above to make a request. You may also complain to your local data-protection authority; in the Netherlands this is the Autoriteit Persoonsgegevens.
Changes to this notice
This notice will be updated when the website’s data handling changes. The date at the top identifies the latest update.