Privacy Policy
Last updated: October 2026
Overview
This is the personal portfolio site of Yonatan Gross (yonyon.ai). It is a content site with a few interactive features. There are no user accounts, no logins, and nothing for sale. This policy explains what data the site touches and why.
What we collect
- Usage analytics. We use Vercel Analytics, PostHog and Google Analytics to understand aggregate traffic: pages viewed, approximate location, device and browser type, and referrers. Before you answer the cookie banner, and if you decline, PostHog counts page views without cookies and without any identifier stored in your browser. To count visits in that mode, PostHog computes a hash of your IP address and browser user agent on its own servers, with a salt that changes every day, so no cookie or stored identifier is needed and the hash cannot link your visits across days. This helps improve the site. It is not used to identify you personally.
- Chat messages. If you use the AI chat on the site, the messages you send are forwarded to Anthropic's API to generate a reply. Those messages are used only to produce the response. They are not sold, and they are not used to train models. Requests are rate-limited. Please do not enter sensitive personal information into the chat.
- Bookings. If you book an intro call, scheduling is handled by Cal.com, which collects the details you provide (such as your name and email) to arrange the meeting. Cal.com's own privacy terms apply to that data.
Newsletter
If you subscribe to the newsletter, your email address is stored with Resend (our email delivery provider) together with a timestamped record of when and from which part of the site you subscribed. Subscription is double opt-in: you only start receiving issues after clicking the confirmation link we email you. Your address is used solely to send the newsletter. It is not sold or shared for marketing.
Every issue includes a one-click unsubscribe link, and your mail app's native unsubscribe button is supported too. Unsubscribing takes effect immediately. Addresses that bounce or report an issue as spam are suppressed automatically.
Rate limiting
To stop abuse, the AI chat, the site scanner, the contact form and the newsletter signup count requests per IP address in Upstash, a hosted Redis database. Your IP address is stored as it is, not hashed, in the counter's key. Each counter is deleted automatically: after at most 121 seconds for the chat and the scanner, and after at most 7,201 seconds (about two hours) for the contact form and the newsletter signup.
Newsletter and follow-up records
Upstash also holds records linked to your email address, but never the address in plain text. Newsletter consent records (the change, which part of the site it came from, and the time) are keyed by a one-way SHA-256 hash of the address and do not expire, because they are the proof of consent. When a welcome email in the newsletter sequence is sent, a marker with the send time is kept under the same kind of hash, also without expiry. Two records tied to calls expire after 25 days: after an intro call, a follow-up record holding your email address encrypted with AES-256-GCM, with your name and the time stored in plain text; and if you book a Discovery call, a marker under the hash of your address with the booking time.
Social media publishing
Yonatan uses a social media scheduling tool (Postiz) to publish posts to his own LinkedIn, X, Meta and TikTok accounts, on his instruction only. To do that, the tool stores the access each platform grants when he connects one of his accounts, and the posts he writes. It does not act on anyone else's account and it is not used to collect personal data about people who view or reply to the posts. Revoking the app in the platform's settings removes that access.
Cookies
The site shows a consent banner for non-essential cookies. If you accept, analytics may set cookies to recognise a returning browser. If you decline or do not answer, page views are still counted anonymously, without cookies and without any stored identifier. Essential cookies needed for the site to function may still be set.
How your data is used
We do not sell your personal data, and we do not share it with third parties except the service providers described above (Vercel, PostHog, Google Analytics, Anthropic, Cal.com, Resend, and Upstash) that are needed to run the corresponding feature. Data is used only to operate and improve the site.
Hosting
The site is hosted on Vercel and served through Cloudflare. As part of delivering and securing the site, these providers process standard request data such as IP addresses.
Data requests and contact
To ask what data relates to you, or to request correction or deletion, email [email protected]. We will respond as promptly as we reasonably can. Use the same address for any other privacy questions.