Privacy Policy

Last updated: July 2026

This policy covers danielcheung.com. Written plainly — no legalese.

The short version

This site collects no personal information directly. The only third-party data collection is standard server logging (Vercel) and aggregate traffic analytics (Google Analytics).

Governing law

This site is operated by Daniel Cheung, based in Australia. It is guided by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) set out in Schedule 1 of that Act, as amended by the Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024). As a personal site with turnover below AUD $3 million, it currently qualifies for the small business exemption under the Act. Note that this exemption is under active review and may be removed in future legislative reforms — but this policy reflects the spirit of the APPs regardless.

Because this site uses analytics cookies that process the IP addresses of all visitors, it falls within the territorial scope of the EU General Data Protection Regulation (GDPR, Article 3(2)(b)) and the UK GDPR as read with the Data Protection Act 2018 (c. 12). The rights and obligations described in this policy apply accordingly.

What this website collects

Server logs. This site is hosted on Vercel, which automatically logs standard request data — IP address, browser type, referring URL, timestamp — for operational and security purposes. These logs are held under Vercel's privacy policy and are not directly accessible to or controlled by this site.

Google Analytics. This site uses Google Analytics 4 (GA4) to understand aggregate traffic — pages visited, session duration, referral source. GA4 processes IP addresses (anonymised by default for EU visitors) and sets cookies to distinguish sessions. The lawful basis for this processing is legitimate interests (GDPR Article 6(1)(f)): understanding how the site is used in order to improve it. No personally identifiable information is intentionally collected or linked.

Note: regulatory guidance on GA4's GDPR compliance continues to evolve across EU member states. Several national data protection authorities have found GA4 use problematic without supplementary measures. If you are in the EEA or UK, you may wish to use the Google Analytics opt-out browser add-on or a privacy-focused browser to limit this processing.

Cookies and browser storage

  • site_theme (localStorage) — your light/dark mode preference. Never leaves your browser.
  • Google Analytics (cookies) — aggregate session tracking. Governed by Google's privacy policy.

No advertising cookies or cross-site tracking identifiers are set by this site.

Third-party services and international transfers

Both third-party services used by this site are based in the United States. Transfers of personal data outside Australia, the EEA, and the UK are covered as follows:

  • Vercel — hosting and infrastructure. Transfers covered by the EU–US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs, Regulation (EU) 2021/914).
  • Google — Analytics. Transfers covered by the EU–US DPF and SCCs. Google holds a Data Processing Agreement available to site operators.

Your rights

Under the Australian Privacy Principles, you have the right to access personal information held about you and to request its correction.

Under the GDPR and UK GDPR, you additionally have the right to erasure (Article 17), the right to object to processing on grounds of legitimate interests (Article 21), and the right to access a copy of your personal data (Article 15).

Because this site holds no personal data of its own — only Vercel's server logs and Google's analytics data — most of these rights are best exercised directly with those providers. If you have a specific concern, reach out via danielkcheung@gmail.com or LinkedIn.

Complaints

If you believe your privacy rights have been breached, you can lodge a complaint with the relevant authority:

Changes to this policy

If data handling practices change materially, this page will be updated with a new date. Given the evolving regulatory landscape — particularly around analytics and AI — this policy will be reviewed periodically.