privacy policy //

1. who we are

hejes.my is a bilingual technology blog (English and Bahasa Melayu) operated by a single human operator. This policy explains what personal data we process, why, and the rights you have over it.

You can reach the operator with any privacy question via the contact form or by emailing the address shown on the contact page.

2. what we collect and why

We collect the minimum needed to run the blog, keep it secure, and reply to you.

• ▸Analytics: when you read an article, we log a hashed visitor identifier, the page path, a country code (from your IP via Cloudflare), the domain you arrived from (referrer), and roughly how long you spent on the page. We do not store your raw IP address or your browsing history.
• ▸Newsletter: if you subscribe, we store your email address and confirmation status, solely to send the newsletter you asked for.
• ▸Contact form: if you message us, we receive your name, email and message — routed straight to the operator inbox. We do not store it in a database.
• ▸Security: for rate limiting we briefly retain a hashed form of your IP for a short window, then discard it.
• ▸Admin: if you are logged in as an operator, we set a session cookie and a CSRF token. This never applies to ordinary readers.
• ▸Advertising: public pages load Google AdSense (Auto Ads) to fund the blog. Google may set its own cookies and collect data to serve and measure ads, subject to Google's own privacy policy. Depending on your region and Google's consent flow, ads may be personalized (based on your interests) or non-personalized (contextual only) — you can review your personalized-ads choice in your Google account's ad settings. Our analytics consent switch does not control Google's cookies — manage them via your browser settings or Google's ad settings.

3. cookies

Cookies are small text files stored by your browser. Our own cookies are limited to strictly necessary ones and analytics cookies you explicitly consent to.

Public pages also load Google AdSense, which may set third-party advertising cookies of its own. We never sell your data.

4. analytics & consent

By default we run cookieless analytics that does not identify you as an individual. When you consent to cookies, we use a unique, randomly generated visitor identifier (a UUID) instead of IP hashing, which lets us tell returning visitors from new ones and measure which sources bring readers.

You can accept or reject analytics cookies at any time. Rejecting them means our visitor counts are less precise — we fall back to hashed IP aggregates.

Advertising is separate from analytics: Google AdSense loads on public pages whether or not you accept our analytics cookies, and Google's data handling is governed by Google's policies, not this one. Rejecting analytics cookies only stops our own visitor and session identifiers.

5. how long we keep data

• ▸Analytics records: retained for up to 90 days, then automatically deleted.
• ▸Newsletter address: kept until you unsubscribe or request deletion.
• ▸Contact messages: routed to email; not stored in a blog database.

6. third parties

We use a limited set of service providers: Cloudflare for CDN and security, a hosting provider, and an email-sending service for the newsletter. Bot protection on our forms is a self-hosted proof-of-work check (your browser solves a small computation; nothing is sent to a third party for it). Each provider acts on our behalf and we keep the data we share with them to the minimum required.

Ads on public pages are served by Google AdSense, which processes ad data as an independent controller under Google's own policies — not on our behalf.

7. your rights

Depending on where you live (for example under Malaysia's PDPA or the EU/UK GDPR), you may have the right to access, correct, or delete the personal data we hold about you, and to object to or restrict processing.

To exercise any of these, contact us via the contact form or email. We will respond within a reasonable time. To stop receiving the newsletter, use the unsubscribe link in any issue or ask us directly.

8. changes to this policy

We may update this policy from time to time. The 'last updated' date below reflects the most recent change. Continued use of the site after a change means you accept the revised policy.