~/PRIVACY · PLAIN ENGLISH PORTFOLIO

Privacy Policy.

LAST UPDATED · OCTOBER 16, 2026

This is the privacy policy for thyfwxit.com, the portfolio site you are reading right now. The Nexus AI Terminal at /nexus/ has its own, more detailed policy at /nexus/privacy because it handles more data. This document covers the portfolio only. vertex, my terminal coding assistant, has its own policy at /vertex/privacy/. Nexus is down for maintenance right now, so every /nexus/ link on this page lands on a holding page until it is back.

The Nexus Discord bot in my community server has its own policy: Nexus bot privacy policy.

Plain English. No legalese. If something here is unclear, email me and I will fix it.

Who runs this site

Xavier Scott (alias THYFWX), solo. Contact: xavier@thyfwxit.com. There is no company, no team, no third party operator. The site is hosted on Cloudflare Pages.

What thyfwxit.com itself collects

Almost nothing. The portfolio is static HTML/CSS/JS. There is no user account on the portfolio root, no login, no profile. When you load the page, your browser fetches files and renders them. That is it.

The site uses these specific data points:

  • Accessibility settings: stored in your browser's localStorage. Tracks toggle states you have set (high contrast, reduced motion, larger text, etc.). Never leaves your device. Clearing your browser storage erases it.
  • Contact form submissions: when you submit the contact form on the homepage or the contact page, your message and the email address you provide go to Formspree (formspree.io), a third party form service, which delivers them to my personal inbox. Formspree also keeps a copy in its own dashboard under its own privacy policy. I do not run a database of my own for these messages. Before the form is sent, a Cloudflare Turnstile bot check runs to keep out spam bots (see below).

What I do not collect

  • There are no user accounts on the portfolio root.
  • I do not run third party tracking pixels (no Google Analytics, no Facebook pixel, no Hotjar, no LinkedIn Insight).
  • I do not sell, rent, share, or monetize any data from this site.
  • I do not build behavioral profiles.
  • I do not track you across other websites.

Cloudflare (the host)

The site is hosted on Cloudflare Pages. Cloudflare automatically logs HTTP request metadata for every visitor, IP address, user agent, requested URL, timestamp, as part of how a CDN works. This data is used by Cloudflare for security (Bot Fight Mode, DDoS mitigation) and aggregated traffic analytics. I see aggregate counts (visitors per day, top countries, top pages) in my Cloudflare dashboard. I do not see individual visitor identities or IP addresses tied to behavior.

Cloudflare's own privacy policy: cloudflare.com/privacypolicy.

Cookies

The portfolio root does not set any cookies of its own. No analytics cookie, no preference cookie, no session cookie. If you have visited /nexus/ and signed in, a Nexus session cookie may be set under the .thyfwxit.com domain, see the Nexus privacy policy for details.

Third party content embedded on this page

  • Formspree (formspree.io): receives your contact form message and email address when you submit the form, so it can deliver them to me. Formspree stores submissions under its own privacy policy.
  • Cloudflare Turnstile (challenges.cloudflare.com): a privacy focused "are you a robot" check on the contact form, so bots cannot spam it. It runs a lightweight challenge in your browser and sends a one time token to Cloudflare to verify you are human. Unlike Google reCAPTCHA it sets no advertising cookies and is not used to track you. Covered by Cloudflare's privacy policy.
  • Google Fonts: Fira Code, Instrument Sans, and Instrument Serif are loaded from fonts.googleapis.com. Google receives your IP address as a normal part of font delivery. No cookies are set by the Google Fonts CSS endpoint.
  • Live status row: the home lab status on the front page pulls a small JSON liveness check from api.thyfwxit.com (my own Cloudflare Worker). It only reports whether my public services are up. No third party, no personal data.
  • Latest commit feed: the Nexus preview boot sequence calls api.github.com to fetch the latest commit on my public Nexus repo. Public, no auth, no cookies.

Advertising

The portfolio root has no ads. Some standalone pages under /nexus/ (speed test, leaderboard, about, changelog, invaders, typing) display Google AdSense ads with non personalized targeting. See /nexus/privacy for the full ad related policy.

Moderation and abuse logging

When you sign in to the Nexus AI Terminal, the following data is logged to a private, access-restricted channel for moderation and abuse prevention:

  • IP address
  • General location (city and region, derived from IP)
  • Device type and browser
  • Google account name and email address (from your sign-in)

This log is only accessible to me (Xavier Scott). It is used solely to detect ban evasion, policy violations, and abuse. It is not shared with any third party, not used for advertising, and not monetized.

vertex

vertex, my terminal coding assistant, has its own privacy policy at /vertex/privacy/. It covers what vertex keeps on your Mac, what goes to the AI provider or Nexus server you choose, and how to have records deleted.

Children

This site is not directed at children under 13. I do not knowingly collect personal information from children under 13. If you believe a minor has submitted personal information to this site through the contact form, email me and I will delete it.

Your rights

To delete a contact form submission you sent, email me. To clear your accessibility settings, clear your browser's site data for thyfwxit.com. If you use vertex through my Nexus server, the vertex records and deletion steps in the vertex privacy policy apply too.

If you are in the EU/EEA, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA / CPRA, primarily the right to access, correct, or delete the limited personal data described above. The personal data I hold about you is whatever you sent through the contact form, plus the vertex records described in the vertex privacy policy if you used my Nexus server. Email xavier@thyfwxit.com to exercise any of those rights.

Liability

To the extent the law allows, my total liability to you for all claims about this site, vertex, or how I handle the information described here is limited to the greater of 50 US dollars or what you paid me to use them. The site and vertex are free. This is the same single limit as in my terms, not a separate one, and it does not limit anything the law does not let me limit.

Governing law

This policy is governed by U.S. law, the same as my terms. That does not take away protections that apply to you and can't legally be waived.

Indemnification

To the extent the law allows, you agree to cover losses and reasonable legal costs I face from a third party claim caused by your unlawful use of this site or vertex, or by content you sent through them without the right to. This does not cover losses caused by my own negligence or misconduct. It is the same obligation as in my terms, not an extra one.

Changes

If this policy changes materially, I will update the "Last updated" date at the top and, where possible, note what changed.

Contact

xavier@thyfwxit.com, for any privacy question, takedown request, or correction. I read every message and answer within 48 hours.