~/PRIVACY · PLAIN ENGLISH PORTFOLIO ROOT ONLY

Privacy Policy.

LAST UPDATED · JUNE 25, 2026

This is the privacy policy for thyfwxit.com, the portfolio site you are reading right now. The Nexus AI Terminal at /nexus/ has its own, more detailed policy at /nexus/privacy because it handles more data. This document covers the portfolio root only.

Plain English. No legalese. If something here is unclear, email me and I will fix it.

Who runs this site

Xavier Scott (alias THYFWX), solo. Contact: xavier@thyfwxit.com. There is no company, no team, no third party operator. The site is hosted on Cloudflare Pages.

What thyfwxit.com itself collects

Almost nothing. The portfolio is static HTML/CSS/JS. There is no user account on the portfolio root, no login, no profile. When you load the page, your browser fetches files and renders them. That is it.

The site uses these specific data points:

  • Accessibility settings: stored in your browser's localStorage. Tracks toggle states you have set (high contrast, reduced motion, larger text, etc.). Never leaves your device. Clearing your browser storage erases it.
  • Contact form submissions: when you submit the contact form on the homepage or the contact page, your message and the email address you provide go to Formspree (formspree.io), a third party form service, which delivers them to my personal inbox. Formspree also keeps a copy in its own dashboard under its own privacy policy. I do not run a database of my own for these messages.

What I do not collect

  • I do not have a user accounts system on the portfolio root.
  • I do not run third party tracking pixels (no Google Analytics, no Facebook pixel, no Hotjar, no LinkedIn Insight).
  • I do not sell, rent, share, or monetize any data from this site.
  • I do not build behavioral profiles.
  • I do not track you across other websites.

Cloudflare (the host)

The site is hosted on Cloudflare Pages. Cloudflare automatically logs HTTP request metadata for every visitor, IP address, user agent, requested URL, timestamp, as part of how a CDN works. This data is used by Cloudflare for security (Bot Fight Mode, DDoS mitigation) and aggregated traffic analytics. I see aggregate counts (visitors per day, top countries, top pages) in my Cloudflare dashboard. I do not see individual visitor identities or IP addresses tied to behavior.

Cloudflare's own privacy policy: cloudflare.com/privacypolicy.

Cookies

The portfolio root does not set any cookies of its own. No analytics cookie, no preference cookie, no session cookie. If you have visited /nexus/ and signed in, a Nexus session cookie may be set under the .thyfwxit.com domain, see the Nexus privacy policy for details.

Third party content embedded on this page

  • Formspree (formspree.io): receives your contact form message and email address when you submit the form, so it can deliver them to me. Formspree stores submissions under its own privacy policy.
  • Google Fonts: Fira Code, Instrument Sans, and Instrument Serif are loaded from fonts.googleapis.com. Google receives your IP address as a normal part of font delivery. No cookies are set by the Google Fonts CSS endpoint.
  • Live status row: the home lab status on the front page pulls a small JSON liveness check from api.thyfwxit.com (my own Cloudflare Worker). It only reports whether my public services are up. No third party, no personal data.
  • Latest commit feed: the Nexus preview boot sequence calls api.github.com to fetch the latest commit on my public Nexus repo. Public, no auth, no cookies.

Advertising

The portfolio root has no ads. Some standalone pages under /nexus/ (speed test, leaderboard, about, changelog) display Google AdSense ads with non personalized targeting. See /nexus/privacy for the full ad related policy.

Moderation and abuse logging

When you sign in to the Nexus AI Terminal, the following data is logged to a private, access-restricted channel for moderation and abuse prevention:

  • IP address
  • General location (city and region, derived from IP)
  • Device type and browser
  • Google account name and email address (from your sign-in)

This log is only accessible to me (Xavier Scott). It is used solely to detect ban evasion, policy violations, and abuse. It is not shared with any third party, not used for advertising, and not monetized.

Children

This site is not directed at children under 13. I do not knowingly collect personal information from children under 13. If you believe a minor has submitted personal information to this site through the contact form, email me and I will delete it.

Your rights

To delete a contact form submission you sent, email me. To clear your accessibility settings, clear your browser's site data for thyfwxit.com. There is no other personal data on file for portfolio visitors.

If you are in the EU/EEA, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA / CPRA, primarily the right to access, correct, or delete the limited personal data described above. The only personal data this site holds about you is whatever you voluntarily sent through the contact form. Email xavier@thyfwxit.com to exercise any of those rights.

Changes

If this policy changes materially, I will update the "Last updated" date at the top and, where possible, note what changed. The history is in the public git log.

Contact

xavier@thyfwxit.com, for any privacy question, takedown request, or correction. I read every message and answer within 48 hours.