Privacy Policy

Last updated 2026-06-30

Overview

This Privacy Policy explains how Zachary Montague ("I," "me," or "my") handles information in connection with this personal professional website. The site is designed with minimal data collection. It does not use advertising trackers, analytics cookies, or newsletter sign ups.

Data controller

Data controller: Zachary Montague. Location: Trenton, Illinois, United States. Privacy contact: the email address listed on this site. For privacy requests, email with the subject line "Privacy Request." I do not sell personal information.

Scope

This policy applies to this website and its subpages (including /terms and /privacy) and public JSON endpoints used by the site (including /data/prompt.json and /data/terminal.json). It does not apply to third party services you reach through links (such as LinkedIn, email providers, or AI platforms), which process data under their own policies.

Information you provide voluntarily

If you contact me by email or LinkedIn, you choose what information to share (for example, your name, email address, message content, or resume if you attach one). That communication is handled through those services and their privacy policies. Legal basis (GDPR): consent and/or steps at your request before a contract. I use that information only to respond and for related professional correspondence.

Information collected automatically

Like most websites, the hosting environment and web server may process technical data when you visit, such as IP address, date and time of request, requested URL, HTTP method, referrer, and browser or device user agent. This data is used for security, abuse prevention, reliability, and troubleshooting. Legal basis (GDPR): legitimate interests in operating and protecting the site. I do not use this data for advertising profiles.

Cookies and browser storage

This site does not set non essential cookies and does not use third party analytics or advertising cookies. The interactive terminal may store one session flag in sessionStorage (key: linuxcowboy-boot-seen) so the boot splash does not repeat during the same browser tab session. That value stays on your device, is not sent to a database, and is cleared when the session ends. Your browser may also cache public CSS, JavaScript, images, and JSON responses (including /data/prompt.json and /data/terminal.json) using normal HTTP caching. That cache is not used for tracking or profiling. Legal basis (GDPR/ePrivacy): strictly necessary for a function you request. No cookie consent banner is required for this storage because it is not used for tracking or profiling.

Clipboard

If you click "Copy prompt" or an "Ask AI" button, the site may fetch /data/prompt.json (if not already cached) and write the research prompt to your device clipboard using your browser's clipboard API. Ask AI links open the external platform only after your click. I do not receive clipboard contents. Legal basis: your consent through the click.

Public professional and machine readable content

This site displays professional information I have chosen to make public, including at /llms.txt, /llms-full.txt, /data/prompt.json, and /data/terminal.json for search engines, AI systems, and site features. These files contain the same class of public professional information shown on the site. AI crawlers listed in robots.txt may index that content. After you load the homepage, the site may request /data/terminal.json to power the interactive terminal and may prefetch /data/prompt.json in the background to improve Ask AI responsiveness. Those requests may appear in server logs as described above. Legal basis: legitimate interests in professional visibility, accurate public representation, and site operation. If you are an EU/UK visitor, you may object to processing based on legitimate interests as described under "Your rights" below, though much of this information is intentionally public by design.

Recipients and processors

Data may be processed by: (1) my hosting/infrastructure provider, acting as a processor or subprocessor for server delivery and logs; (2) LinkedIn, if you use LinkedIn links; (3) your email provider, if you email me; (4) AI platforms (such as OpenAI/ChatGPT, Anthropic/Claude, Google/Gemini, xAI/Grok, or Microsoft/Copilot), if you choose to open those services from this site. I do not control how those third parties process data.

International transfers

I am based in the United States. If you access the site from the European Economic Area, United Kingdom, or other regions with data transfer rules, your technical log data and any information you send me may be processed in the United States and other countries where service providers operate. Where required, appropriate safeguards (such as Standard Contractual Clauses offered by major providers) may apply between processors and subprocessors. Contact me for more detail about a specific provider you use to reach this site.

Retention

Server and security logs: typically retained by the hosting provider for a limited period (often about 30 to 90 days unless longer retention is required for security investigations). sessionStorage: until you close the browser tab. Browser HTTP cache for public assets and JSON endpoints: controlled by your browser settings and cache headers (public JSON responses may be cached up to about 24 hours with stale revalidation). Email and LinkedIn messages: retained as long as needed for professional correspondence and legal obligations, then deleted or archived responsibly. Public site content: retained while the profile remains published.

Security

Reasonable technical and organizational measures are used to protect the site, including security headers, restricted access to private files, HTTPS in production, and method restrictions. No method of transmission over the internet is perfectly secure.

Your rights (GDPR and UK GDPR)

If GDPR or UK GDPR applies to you, you may have the right to: access your personal data; rectify inaccurate data; erase data in certain cases; restrict processing; object to processing based on legitimate interests; data portability where applicable; and withdraw consent where processing is based on consent. To exercise these rights, contact me by email. I may need to verify your request. You also have the right to lodge a complaint with your local supervisory authority (for example, your EU member state data protection authority or the UK ICO).

US state privacy rights

Residents of certain US states (including California, Colorado, Connecticut, Virginia, and others with consumer privacy laws) may have rights to know, access, delete, and correct personal information, and to opt out of sale or sharing. This site does not sell or share personal information for cross context behavioral advertising. Submit requests using the privacy contact email. I will not discriminate against you for exercising privacy rights.

Automated decision making

This site does not use automated decision making or profiling that produces legal or similarly significant effects on you. "Ask AI" links open external tools you control; they are not operated by this site.

Changes to this policy

This policy may be updated from time to time. The "Last updated" date at the top shows when it was last revised. Material changes will be posted on this page.

Contact

Privacy questions or rights requests may be sent by email or LinkedIn. Contact details are listed on the site.

Contact: LinkedIn