The short version: I want to know which case studies get read. That's it.

Who I am

This site is a personal portfolio run by Fanni Csincsák, based in Budapest, Hungary. For anything on this page, the contact is csincsakf@gmail.com.

If you send me a message

The contact form is handled by Web3Forms, which passes your message to my inbox. What you type — your name, your email, and what you wrote — is what gets sent. I keep it only as long as the conversation is live, and I don't add you to anything.

The legal basis is your consent: you filled in the form because you wanted to reach me.

Analytics — only if you agree

If you accept the banner, this site loads Google Analytics 4 and PostHog. PostHog runs on its EU servers, so that data stays in the EU, and includes session replay — an anonymised reconstruction of how pages are used, with all text and form inputs (including anything you type) automatically masked, and recording switched off entirely on the password-protected case studies. If you decline, or ignore it, neither one loads at all — not in a limited form, not anonymously. They simply don't run.

When they do run, I'm looking at a small number of things: which case studies people read and for how long, whether the CV gets downloaded, and whether anyone gets in touch. IP addresses are anonymised. There is no advertising, no remarketing, no cross-site profiling, and no data sold or shared with anyone.

Google Analytics is the exception: Google processes some data in the United States, under its standard contractual clauses and the EU–US Data Privacy Framework. IP addresses are anonymised before it gets there. If you'd rather none of it happened, decline the banner — the site works exactly the same either way, and I'll never know you were here.

Changed your mind? Clear this site's data in your browser and the banner will ask again.

Cookies and local storage

• Your consent choice — stored in your browser so I don't ask on every page. Strictly necessary; no way around this one.
• Analytics & session-replay cookies — set by Google Analytics and PostHog, but only after you accept.

That's the entire list. No trackers from anyone else.

Protected case studies

Some of my work runs at my current employer and sits under NDA. Those pages are encrypted (AES-256) and the content is only decrypted in your browser after you enter the shared password. Entering it doesn't identify you and doesn't send anything to me — though if analytics are on, I do record that a page was unlocked, without knowing who did it. Session replay is disabled on these pages entirely, so nothing you do behind the password is ever recorded.

Your rights under GDPR

You can ask me for a copy of anything I hold about you, ask me to correct it, or ask me to delete it. You can withdraw consent at any time, and you can complain to the Hungarian data protection authority (NAIH) if you think I've handled something badly.

Email csincsakf@gmail.com and I'll deal with it. In practice, for most visitors, there's nothing to delete: if you didn't message me and didn't accept analytics, I have nothing.

Processors I use

• Web3Forms — contact form delivery
• Google Analytics 4 — analytics, US-hosted (consent only)
• PostHog — product analytics & masked session replay, EU-hosted (consent only)
• Cal.com — loads only if you open the booking modal
• The host — serves the site and keeps standard server logs