This website is run by Muhammad Firdaus bin Aminullah, working as firdausthedev, a freelance web developer based in Malaysia. For the purposes of the Personal Data Protection Act 2010 (PDPA), I am the data controller for any personal data this site processes.

You can reach me about anything in this policy at firdausthedev@gmail.com.

This policy covers the website at firdausthedev.vercel.app only. It does not cover any other site you reach by clicking a link from here, and it does not cover work I do for clients under a separate agreement.

This site has no contact form, no search box, no sign-up, no account, and no payments. There is nowhere on this site for you to type anything, so nothing you type is collected. If you email me using the address on the contact page, that email goes to my inbox like any other email.

What is collected happens automatically, through four services:

• Google Analytics 4 — pages you view, the site that referred you, an approximate location worked out from your IP address, your device type, browser and operating system, and a randomly generated ID stored in a cookie so repeat visits can be counted as one visitor.
• Vercel Web Analytics — pages you view, referrer, country, and device type. Vercel states this is collected without cookies and is aggregated rather than tied to an individual.
• Vercel Speed Insights — how quickly pages load and respond for you, recorded against the page address and a broad device category. No cookies.
• Vercel hosting — as the host, Vercel processes ordinary server request logs, which include your IP address, browser user agent, and the page requested.

Separately, the project screenshots on this site are served directly from Cloudinary, an image hosting service. Because your browser fetches those images from Cloudinary rather than from this site, Cloudinary receives your IP address, browser user agent, and the page you were on.

I do not collect your name, email address, phone number, postal address, date of birth, payment details, or any government identifier, because there is no mechanism on this site that could.

Google Analytics sets two cookies in your browser, named _ga and _ga_ followed by the measurement ID. They hold a randomly generated identifier and a session timestamp. They do not contain your name or email.

This site also stores a single item in your browser's local storage, under the key theme. It records whether you chose light mode, dark mode, or system default, so the site does not flash the wrong colour scheme on your next visit. It never leaves your browser.

The Vercel analytics and speed measurements described above do not use cookies.

You can stop the Google Analytics cookies by:

• blocking or clearing cookies for this site in your browser settings,
• installing Google's Analytics Opt-out Browser Add-on, or
• turning on your browser's tracking protection, which blocks these scripts in most modern browsers.

Blocking them has no effect on how the site works. Nothing here is behind a cookie.

To be straightforward with you: this site does not currently show a cookie consent banner, so the Google Analytics cookies are set when you arrive rather than after you agree. If you would rather they were not, the options above are the way to prevent them.

Only to understand whether this portfolio is working: how many people visit, which projects they look at, roughly where they come from, and whether pages load quickly enough. It is a freelance portfolio, so knowing which work gets attention genuinely changes what I build next.

It is not used to build a profile of you, to target advertising, or to make any automated decision about you. Google Signals, user-provided data collection, and the User-ID feature are all turned off on the Analytics property, and it is not linked to any Google Ads account.

I do not sell your data, rent it, or trade it. There is no mailing list.

The only parties that receive data are the service providers that collect it in the first place: Google (Analytics), Vercel (hosting and analytics), and Cloudinary (images). Each processes it under its own privacy policy and terms.

Beyond that, I would only disclose data where the law requires it — for example a valid order from a Malaysian court or regulator.

Google, Vercel, and Cloudinary are all based outside Malaysia and run their infrastructure across multiple countries, including the United States. Using this site therefore involves your data being transferred to and processed in places outside Malaysia.

I rely on the contractual and security commitments those providers publish. If you are not comfortable with that transfer, the opt-out steps in section 4 prevent the analytics portion of it.

This site itself stores nothing — there is no database and no server-side storage of visitors. Retention is whatever the providers apply:

• Google Analytics: event data is kept for 2 months and user-level data for 14 months, after which Google deletes it. Aggregated reports remain.
• Vercel Analytics and Speed Insights: retained according to Vercel's own retention windows for the plan this site runs on.
• Vercel server logs: retained short-term by Vercel for operational and security purposes.

The site is served only over HTTPS, so traffic between your browser and the site is encrypted. Because no visitor data is stored by the site, there is no database of yours for me to lose. The data that does exist sits with Google, Vercel, and Cloudinary, and is protected by their security measures rather than mine.

No method of transmission over the internet is completely secure, and I cannot promise absolute security.

Malaysia's Personal Data Protection Act 2010, as amended in 2024, gives you the right to:

• ask what personal data about you is being processed, and get a copy of it;
• have inaccurate, incomplete, or out-of-date data corrected;
• withdraw your consent to processing;
• require that processing stop where it causes you damage or distress;
• require that your data not be used for direct marketing; and
• ask for your data to be transmitted to another data controller, where that is technically feasible.

In practice there is a limit to what I can act on directly: the analytics data is pseudonymous, so without the random identifier from your own browser I have no way to find "your" rows and no way to verify they are yours. What you can do immediately is clear this site's cookies and local storage in your browser, which severs the link entirely.

For anything else, email firdausthedev@gmail.com and I will respond within 21 days, which is the period the PDPA sets. If you are not satisfied, you can complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi) under the Ministry of Digital.

This site links out to GitHub, X (Twitter), Frontend Mentor, Google Play, freeCodeCamp, and to live demos of my projects hosted on Vercel. Once you follow one of those links you are on someone else's site, governed by their privacy policy, not this one. I have no control over what they collect.

This site is aimed at prospective clients and fellow developers, not at children. I do not knowingly collect personal data from anyone under 18. If you believe a child's data has somehow reached me, email firdausthedev@gmail.com and I will delete it.

If I add a service that collects something new, or change how an existing one is used, I will update this page and change the date at the top. There is no mailing list to notify, so the date is the signal — worth a glance if you care.

Questions, requests, or corrections: firdausthedev@gmail.com.