Skip to content

Download CV

Book a call

Privacy

Privacy policy

This site is my personal resume. It has no accounts and no ads, and I never sell or share your data. This page explains exactly what happens when you visit it.

Last updated:

In short

  • Analytics cookies are set only if you accept them. Until then, Google Analytics receives cookieless measurements only.
  • The text you type or paste (forms, the fit check, questions) is never sent to analytics.
  • Semantic search runs on your device, and its model is downloaded only when you turn it on.
  • No ads, no profiling, and no selling or sharing of data.

Who is responsible

Oscar Arenas, based in Bogotá, Colombia, is responsible for this site and for the data described here. For any privacy question or request, write to oscarenas@gmail.com .

Analytics (Google Analytics 4)

I use Google Analytics 4, a Google service, to learn which parts of the resume are useful. It runs in Consent Mode v2, and the Google tag is fetched once the page has finished loading or on your first click or key press, whichever comes first.

Before you choose, or if you reject

No analytics cookies are set, and nothing that identifies your browser is stored on your device. Google receives cookieless measurements (for example, “a page was viewed” or “the CV was downloaded”) without a persistent identifier.

If you accept

Google Analytics sets two first-party cookies, _ga and _ga_<ID>, that let it recognize a returning browser. They expire 13 months after your first visit.

What is collected

  • Pages viewed, the site you came from, and the tags in the link that brought you here (utm_*, focus, for).
  • Approximate location (country and city), which Google derives from your IP address.
  • Device type, browser, operating system, screen size and language.
  • Named interactions: links and buttons clicked, sections viewed, scroll depth, CV downloads, whether a form was sent and whether it worked, and the names of the agent tools used.
  • How fast the page was for you (LCP, INP, CLS, FCP and TTFB, with the page element involved) and shortened JavaScript error messages.

What is never collected

The text you type or paste (contact form, fit check, questions, filters), your name and your email address.

How it is configured

  • Google signals and ad personalization are off, and ad storage is always denied: nothing is used for advertising.
  • According to Google, Analytics 4 does not log or store IP addresses; it uses them to derive the approximate location and then discards them.
  • Event-level data is deleted automatically after 14 months at most; only aggregated reports remain.
  • Google processes this data on my behalf and may do so outside your country, including in the United States.

You can change your choice at any time with “Cookie settings”, here or at the bottom of every page. You can also block Google Analytics on every site with Google’s opt-out browser add-on.

Performance badge

The footer shows the Core Web Vitals measured during your own visit (LCP, INP and CLS). Your browser calculates them with web-vitals, Google’s open-source library. The same values are sent to Google Analytics as described above, so I can see how fast the site is for real visitors.

Agent Lab and on-device semantic search

The Agent Lab tools (fit check, tailored CV, questions about my experience) run in your browser. What you type or paste is processed on your device and is not uploaded.

Semantic search needs a language model (Xenova/multilingual-e5-small, about 138 MB). It is downloaded only after you press the button to turn it on: the model files come from Hugging Face (huggingface.co, which serves the downloads from its *.hf.co servers) and the ONNX Runtime WebAssembly files from jsDelivr (cdn.jsdelivr.net). Like any download, those providers receive your IP address and browser details, but never your text.

The files are then kept in your browser’s cache storage. The “Remove from this browser” button in the Agent Lab deletes them.

Contact form and booking

The contact form doesn’t send anything by itself: it opens your own email app with the message filled in, and you decide whether to send it.

Hosting

This site is hosted on Firebase Hosting (Google). To deliver the pages, its servers process your IP address and browser details. If request logging is turned on, those logs are kept for up to 30 days. Fonts and every other site file are served from this domain.

What is stored on your device

  • theme: your light or dark mode choice (local storage).
  • analytics-consent: your cookie choice and its date (local storage). I ask again after 12 months.
  • cv-focus and campaign-greeting-dismissed: only if you arrive through a tailored link (session storage, cleared when you close the tab).
  • The semantic search model files, if you download them (cache storage).
  • analytics-internal: only on my own devices, to leave my visits out of the statistics (local storage).
  • _ga and _ga_<ID> cookies, only if you accept analytics.

Your rights

Under Colombian law (Ley 1581 de 2012) and, if you are in the European Union or the United Kingdom, the GDPR, you can ask to access, correct or delete your data, object to its use, or withdraw your consent at any time. Write to oscarenas@gmail.com ; I reply within the legal deadlines.

Analytics data is not linked to your name, so I can only find it with the identifier stored in your _ga cookie.

You can also complain to a data protection authority; in Colombia, that is the Superintendencia de Industria y Comercio (SIC).

Changes

If this policy changes, I will update this page and the date at the top.