Last updated 17 August 2026
Who is responsible
I am Dhruv Tripathi, a product and design engineer based in the GMT+1 timezone. I am the controller for personal data processed through dhruvtrip.com.
For access, erasure, objection, or questions, message me on LinkedIn. LinkedIn is a third-party inbox, not a dedicated privacy mailbox.
What I collect
Always on (no PostHog cookies)
When you load a page, PostHog Cloud EU receives cookieless analytics: page views and leaves, referrer and UTM parameters, web vitals, clicks I explicitly instrument (work opened, filters, theme, outbound links, contact CTAs), and coarse device/browser data. PostHog hashes IP address and user agent on its servers with a daily salt, then discards the IP. There is no persistent distinct ID, no advertising identifier, and no GeoIP location on these events.
Lawful basis: legitimate interest (GDPR Art. 6(1)(f)) in understanding how a public portfolio is used so I can improve it, balanced against your interest in remaining anonymous. This is audience measurement, not advertising.
Only if you allow recordings
If you opt in, PostHog may store first-party cookies and localStorage, keep an anonymous identifier across sessions, enrich events with GeoIP, and record a masked session (clicks, scrolls, page structure). Form inputs are masked. I do not use this for ads.
Lawful basis: consent (GDPR Art. 6(1)(a)). You can withdraw it below at any time.
Strictly necessary storage
trip-theme— remembers light or dark theme.trip-analytics-consent— remembers whether you allowed recordings.
These are needed for the site to honour your choices. They are not analytics cookies.
Manage analytics
Who processes this
Analytics are processed by PostHog in the EU cloud (eu.posthog.com). Events are sent through a first-party path on this domain so they are less likely to be blocked. I do not sell data, run ad pixels, or share this with other marketing tools.
Retention follows the default in my PostHog project unless I shorten it there. I aim to keep events no longer than needed to see how the site is used.
Your rights
Under the GDPR you can request access, correction, erasure, restriction, objection to legitimate-interest analytics, and withdrawal of recording consent. Message me on LinkedIn. You can also complain to your local supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens).
A Global Privacy Control signal is treated as a refusal of recordings. Cookieless pageviews still run.
Changes
If what I collect changes, I will update this page. The date at the top is the last revision.