Privacy note.
This is a personal portfolio, not a product collecting your data for profit. Here's exactly what happens when you use it, who else is involved, and what you can ask me to do about it.
// who is responsible
I am: Henry James Underwood, based in Thailand. I decide how this site handles data, and you can reach me at henryjunderwood@gmail.com.
// browsing the site
The site itself sets no cookies and runs no analytics, ads, or tracking pixels. Fonts and scripts are served from this site, so simply reading a page does not contact any third party. The site is hosted on Vercel, which, like any web host, processes your IP address and basic request details in short-lived server logs in order to deliver pages and keep the service secure.
// the music widget
The music is off until you ask for it. If you press play or pick a soundscape, your browser loads a hidden YouTube player. From that point YouTube (Google) receives your IP address and may set its own cookies or storage, under Google's privacy policy, and the player loads on the other pages you visit here until you press pause. Your choices (playing or paused, muted, and which soundscape) are remembered in your browser's localStorage. Those values stay on your device, are not sent to me, and are only written once you use the music controls.
// the chat widget
The "ask about henry" chat widget is an AI assistant. Whatever you type is sent to a backend endpoint I run on Vercel, which passes it to Google's Gemini API to find relevant site content and generate a reply. I do not save your messages to a database, and I don't link them to you. Google is a different matter: I use the free tier of the Gemini API, and under Google's terms for that tier, Google may keep the messages and replies, use them to improve its products, and have human reviewers read them. I can't delete anything Google holds. So please don't type personal, confidential, or sensitive information into the chat.
To prevent abuse, the chat is rate limited. Your IP address is turned into a scrambled value that can't be read back as an address, and that value is kept by Upstash (a Redis provider) for up to about two hours, then it expires. It is not linked to what you typed.
// the private dashboard
The address /dashboard is a private admin area that only I can use, and no page on the site links to it or loads it. If you open it anyway, you'll see a sign-in form run by Clerk, a sign-in service: your browser then contacts Clerk, and Clerk sets the cookies it needs for signing in. I don't record visits to it.
// contact & email
The "Email" link on the contact page opens your own email client via a mailto: link. Anything you send that way goes straight to my Gmail inbox the same as any other email; it doesn't pass through this site. I keep emails for as long as they're useful for the conversation or any work that follows, and I'll delete them if you ask.
// why I'm allowed to do this
Hosting logs and rate limiting rely on my legitimate interest in keeping the site running and protected from abuse. The chat and the music run because you asked for them by using them. I don't sell data or use it for advertising.
// where data goes
Vercel, Google, Upstash, and Clerk (only if you open the dashboard sign-in) operate servers in the United States and other countries, so the data described above may be processed outside the country you live in, and outside Thailand.
// your rights
Wherever you are, you can ask me what data I hold about you, ask me to correct or delete it, or object to how it's used. In practice I hold very little: emails you've sent me, and nothing from the chat or the music widget that I could tie to you. Email me and I'll answer within 30 days. If you're not satisfied, you can complain to your local data protection authority (in Thailand, the Personal Data Protection Committee).
// changes
If the site starts handling data differently, this note will be updated first. Last updated: October 2026.