Armen Ghazaryan

Privacy first: no cookies, no third-party trackers, self-hosted fonts

Nothing to consent to: no cookie banner, no third-party script, fonts served by the site itself, and analytics, when they come, first-party and cookieless.

Status
Accepted 1 October 2026, revised 25 October 2026 · the guide's voice goes through the browser's own speech, not this site · the session cookie covers signed-in visitors since ADR 0023
The record
0007-privacy-first.md

Context

The audience includes EU companies; a cookie banner on a CV site is friction and a poor signal.

Decision

No cookies and no third-party scripts. Fonts are bundled from npm instead of loaded from Google Fonts. The theme preference is the only thing kept in local storage. Analytics are first-party and cookieless: how visits are counted is ADR 0014. The one cookie is the admin's session, set only for whoever starts signing in there, where only the owner gets further (ADR 0016). A posting a visitor checks with the fit check, or a question they ask the assistant, is sent, when they send it, to Anthropic's API to be read; nothing of a posting is kept here, and a conversation's questions stay in the server's memory for thirty minutes at most (ADR 0018, ADR 0019). A question goes with what is on the visitor's screen, by the site's own names for it, and nothing typed into a page (ADR 0021).

The guide's voice (revised 2026-10-25) is the browser's own. A question spoken to it is turned into text by the browser, on the device where it can be (Chrome, where it has English there), otherwise by its maker's service: Google's in Chrome, Apple's in Safari. The site receives the text alone, as if it had been typed; it never receives the audio. The microphone is allowed to the site's own pages and no others (Permissions-Policy: microphone=(self)), listens only once the visitor presses its button, until they let go or stop speaking, and the dock says where speech goes before the first spoken question. Answers are spoken by the browser's own voices, on the device; nothing is spoken that the visitor did not ask for, and never in a likeness of the owner's voice.

Consequences

  • Nothing to consent to; the footer states it plainly.
  • Analytics are coarser than with third-party tools — acceptable for a personal site.
  • A visitor who speaks to the guide in Chrome without the English pack, or in Safari, sends their voice to Google or Apple, as with any site using the browser's speech; the privacy page and the dock say so, and typing avoids it.