Privacy

The public material includes professional biography, employment and education history, résumé data, project descriptions, research artifacts, public profile links, and a professional email address. Machine-readable routes such as résumé JSON, llms.txt, the sitemap, and the read-only MCP endpoint expose subsets of the same public portfolio information. They do not expose protected Field Notes stories, their protected resources, invitation scopes, private repositories, credentials, or unpublished career records.

Field Notes access is owner-issued to an exact professional email address for a defined time window and a fixed snapshot of reviewed notes. The access flow normalizes and hashes the address for lookup, sends a short-lived one-time verification code through Resend only when an active grant exists, and stores only a digest of the resulting opaque session token. Browser cookies used by this flow are secure, HTTP-only, same-site cookies scoped to /field-notes; they are not advertising or behavioral-tracking cookies.

Neon Postgres stores grant revisions, immutable scope snapshots, one-time-code digests and challenge state, session-token digests, projection registry metadata, and minimal security/operation audit events. Vercel Blob stores only reviewed protected projection payloads and resources in private storage. Resend processes the invited email address, the owner-issued invitation email, and short-lived verification messages needed to deliver fresh access codes. Protected Field Notes pages do not run behavioral analytics or session replay, and the system does not maintain a recruiter page-view history.

Operational retention is bounded: terminal verification challenges are eligible for deletion after 7 days; expired or invalid sessions after 30 days; the operational invitation email address is eligible for redaction 30 days after the final grant expiry or revocation; and minimal audit events are retained for up to 180 days. Security-rate records are short-lived. Revocation or scope narrowing takes effect on the next protected request, but it cannot retract material an authorized reader already copied, downloaded, or captured in a screenshot.

The application does not intentionally install advertising pixels, behavioral analytics, or session replay. Vercel hosts the site and processes ordinary technical request information needed to deliver and protect it, which can include network address, user agent, requested path, timing information, and security signals. Field Notes rate limiting derives a keyed network fingerprint at request time rather than persisting the raw network address in the application database. Infrastructure processing is also governed by the relevant provider's policies.

Public email links open the visitor's mail software. Messages are then handled by the sender's and recipient's email providers. GitHub, LinkedIn, Harvard, project documentation, and other external destinations apply their own privacy terms after a visitor follows a link. Do not send passwords, private keys, customer records, medical information, or other secrets through public machine endpoints or unsolicited email.

Questions about this statement can be sent to tv.e5150@gmail.com. The contact page lists the same canonical public address and professional-profile links.