Privacy Policy

In force since 8 September 2026 · Controller: Haruo (haruo.dev) · [email protected]

This policy covers the haruo.dev website. It is short because the site collects little: there is no signup, no login, nothing is sold inside it, and it sets no tracking cookie.

1. What I receive from you

Contact form: name, email, subject and message. Only what you type into those four fields.
SheetsCNPJ waiting list: the "let me know when it opens" button leads to the same form. What arrives is your email and whatever you wrote with it.
Booking: the booking button takes you to Calendly, a third-party site. Whatever you fill in there is handled by them, under their policy, and never passes through here.

Nowhere on this site do I ask for an ID number, a phone number, an address or payment details.

2. Page-view measurement

I use Plausible Analytics to know how many people visit each page. It measures without cookies, stores no IP address, creates no visitor identifier and follows nobody across sites. What I see is counts per page, country and referrer, always aggregated: neither I nor they can work out who you are from it.

There is no other tracker, social pixel or advertising on this site.

3. What I use it for

To answer you, and nothing beyond that. Your message does not go on a mailing list, does not become a behavioural profile and is not used to train any model.

Under Brazil's LGPD (article 7), the message you send is processed to do what you asked for (answer a contact) and for my legitimate interest in keeping the history of the conversation.

4. How long it is kept

Contact message: it becomes an email in my inbox. It stays while the conversation still makes sense and at most 24 months after the last contact. Ask earlier and I delete it earlier.
A contact that became paid work: kept for the term of the contract and for whatever tax law requires afterwards.
Page-view measurement: aggregated from the start, so there is no data of yours to keep or to delete.

5. Who I share it with

I do not sell, rent or trade data with anyone. The transfers that exist are the ones the site needs to work:

A cloud provider, which hosts the pages.
An email delivery service, which puts the message you wrote in the form into my inbox.
Plausible Analytics, as described in section 2.

Beyond that, only when the law requires it, and in that case I tell you unless the law itself forbids me to.

6. Security

Traffic between your browser and the site is encrypted. Access to the inbox where messages arrive is restricted to me, with two-factor authentication. No system is immune, so the usual rule holds: never type a password, an ID number or card details into a contact form, here or anywhere else.

7. Cookies

This site writes no cookie to your browser and stores nothing in its local storage. There is no cookie banner because there is no cookie to consent to.

8. Your rights

At any time you can ask for: confirmation that I hold any data of yours, access to it, correction of anything wrong, deletion, portability, information about who I shared it with, and withdrawal of consent.

Write to [email protected]. I answer within 15 days, and in practice usually within 24 hours. I charge nothing for it and ask for no ID document: a request from the same email address that wrote to me is enough.

9. Third-party sites

This site links to products of mine with their own policies (Tamperlens, lensub, Tradutor Regional, SheetsCNPJ) and to third-party services (Calendly, GitHub, Instagram, LinkedIn, npm). Once you click, you are covered by the policy over there. The SheetsCNPJ one is at /sheetscnpj/privacidade/, in Portuguese.

10. Changes

Any change to this policy shows up on this page, with a new date at the top. If a change widens what I collect, the new date comes with a description of what changed.

This is a translation for convenience. If the two versions ever disagree, the Portuguese one prevails.