Privacy, plainly.

1. Who this policy is from

This site is operated by Rendani Manugeni, an independent creative developer based in South Africa, trading as Function Psi (“I”, “me”, “my”). I am the responsible party for the purposes of South Africa’s Protection of Personal Information Act, 2013 (POPIA), and the controller for the purposes of the EU and UK General Data Protection Regulation (GDPR) where it applies.

This policy covers fnpsi.env.pm and the site’s fnpsi.github.io address. It does not cover the social platforms I link to, or any third-party site you reach from here.

You can contact me about privacy at X / @fnpsi_ or through GitHub / fnpsi.

2. The short version

• There are no accounts, no server-side contact form, no newsletter, no advertising cookies, and no third-party analytics on this site.
• The site stores your cookie choice in your browser. If you accept optional storage, it also remembers the last three project pages you viewed so they can appear on the Projects page.
• The Projects page requests public repository data directly from the GitHub API. GitHub receives your IP address and standard request information. The response is cached in this tab’s session storage for ten minutes, then discarded when the tab closes.
• The Contact page’s brief builder runs entirely in your browser. It does not send, store, or submit what you type. Copying places the text on your clipboard; opening X is an ordinary link.
• Fonts and code libraries are loaded from Google Fonts and jsDelivr. Those providers receive your IP address and standard request information when your browser fetches those files.
• GitHub Pages hosts the site and processes standard server logs. I do not receive a visitor-level analytics report from GitHub Pages.
• You can change or withdraw your choice at any time using Cookie settings in the footer.

No sale, no profiling. I do not sell personal information, rent it, or use it for automated decision-making or behavioural advertising.

3. What this site stores on your device

The site itself does not set cookies. It uses local storage and session storage, which are browser storage mechanisms. They are not cookies, but they are treated with the same care because they can persist between visits or while a tab is open.

The consent record is strictly necessary to remember and respect your choice. The recent-project memory is optional and is only written if you choose Accept all. Choosing Essential only removes any recent-project data and prevents it from being written again. The GitHub cache is functional session storage: it exists only to avoid unnecessary API requests and is cleared when the tab closes.

You can clear local storage through your browser settings at any time. Clearing it will make the consent banner appear again on your next visit, because the site will no longer have a record of your choice.

4. Third-party services

The site is static, but it loads a small number of files from third-party networks. When your browser requests those files, the provider receives your IP address and standard request information such as your user agent, the page you came from, and the time of the request.

• Google Fonts (fonts.googleapis.com and fonts.gstatic.com) supplies the typefaces. Google’s privacy policy explains its processing: policies.google.com/privacy.
• jsDelivr (cdn.jsdelivr.net) supplies the Three.js, GSAP, ScrollTrigger, and Lenis files. jsDelivr’s privacy information is available at jsdelivr.com/privacy-policy-jsdelivr-net.
• GitHub Pages (GitHub, Inc.) hosts and serves the site. GitHub processes standard server logs, including IP addresses, requested paths, and timestamps, for security and abuse prevention. GitHub’s privacy statement is at docs.github.com.
• GitHub API (api.github.com) supplies the public profile and repository data shown on the Projects page. Your browser contacts the API directly. GitHub receives your IP address, user agent, and the requested endpoint. No GitHub account, token, or personal information is sent by this site. The API is subject to GitHub’s privacy statement and rate limits.

There are no embedded social feeds, tracking pixels, advertising networks, or third-party analytics scripts on this site. Social links are ordinary links: the platform only receives information about you if you click through and visit it. The contact console does not transmit anything to me; it composes text in your browser and relies on your clipboard and your own X account when you choose to send it.

5. Why I process information

Where POPIA applies, I rely on the following grounds:

• Consent for the optional recent-project memory, and for any communication you choose to send me through a social platform.
• Legitimate interests in keeping the site secure, responding to messages, and understanding whether the site is working. These interests are balanced against your rights and expectations.
• Legal obligation where I am required to process or retain information by law.
• Contract where processing is necessary to discuss or deliver work you have asked me to do.

Where GDPR applies, the corresponding legal bases are consent (Article 6(1)(a)), legitimate interests (Article 6(1)(f)), legal obligation (Article 6(1)(c)), and contract (Article 6(1)(b)). I do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

6. Sharing

I do not sell, rent, or trade personal information. I share information only in these limited situations:

• With the service providers described above, to the extent they process information as part of delivering the site.
• With professional advisers such as accountants or lawyers, where necessary and under confidentiality obligations.
• With authorities, regulators, or courts where required by law, or to establish, exercise, or defend legal claims.
• With a successor if the practice is transferred, merged, or sold, subject to this policy continuing to apply to existing information.

The recent-project list stays in your browser. It is never sent to me or to a third party by this site. The GitHub cache also stays in your browser and contains only public repository data. The brief builder never sends its contents anywhere.

7. International transfers

I am based in South Africa. Google, jsDelivr, and GitHub may process information in the United States, the European Union, or other countries where they operate. Where POPIA applies, I take reasonable steps to ensure that transfers are lawful and that recipients are subject to laws or binding agreements that provide an adequate level of protection. Where GDPR applies, transfers rely on appropriate safeguards such as standard contractual clauses or an adequacy decision, as applicable to the provider.

8. Retention

• Consent record: kept in your browser until you clear it or change it.
• Recent projects: kept in your browser until you clear it, choose “Essential only”, or view enough projects for older entries to be replaced.
• GitHub cache: kept in session storage for ten minutes or until the tab closes, whichever comes first.
• Messages: kept for as long as needed to respond and, if we work together, for as long as necessary to manage the project and meet legal or accounting obligations. Messages that do not lead to work are deleted when they are no longer useful.
• Hosting logs: controlled by GitHub under its own retention practices. I do not have access to raw visitor logs through GitHub Pages.

9. Security

The site is served over HTTPS through GitHub Pages. It has no server-side database, no login system, and no payment processing. I keep the amount of information the site handles to a minimum, which reduces risk. No method of transmission or storage is completely secure, so I cannot promise absolute security. If you believe you have found a vulnerability, please report it through the process in the repository’s security policy or send a private message on X.

10. Your rights

Depending on where you live, you may have some or all of the following rights:

• Access the personal information I hold about you.
• Correct information that is inaccurate, incomplete, or misleading.
• Delete information that I am not required to keep.
• Object to processing based on legitimate interests.
• Restrict or port information, where GDPR applies.
• Withdraw consent at any time, without affecting processing that happened before withdrawal.
• Complain to a supervisory authority.

To exercise a right, contact me on X or GitHub. I may ask for enough information to verify that the request is genuine. I aim to respond within 30 days. Because the site does not identify visitors, I may not be able to locate any information about you beyond a message you have sent me.

In South Africa, you can complain to the Information Regulator at inforegulator.org.za. In the EU or UK, you can complain to your local supervisory authority.

11. Children

This site is a professional portfolio and is not directed at children. I do not knowingly collect personal information from children under 13 (or under 16 where local law sets a higher age of digital consent). If you believe a child has sent me personal information, contact me and I will delete it.

12. External links

The site links to X, Instagram, GitHub, YouTube, and the websites of libraries and providers. Those sites have their own privacy policies and cookies. I am not responsible for their content or processing. Visiting them is your choice, and it happens outside this site.

13. Changes

I may update this policy when the site changes or when the law requires it. The effective date and version at the top of the page will change, and material updates will be described here. If the site adds analytics, embeds, a server-side contact form, or any other feature that changes how information is handled, this policy will be updated before that feature goes live. The Projects page’s GitHub integration and the Contact page’s local brief builder are described in this version.

14. Contact

Questions, requests, or complaints about privacy can be sent to Rendani Manugeni / Function Psi via X / @fnpsi_ or GitHub / fnpsi. I aim to respond within 30 days.