Privacy Policy

Last updated 2026-09-13

Overview

This Privacy Policy explains how Zachary Montague handles information in connection with this personal professional website. The site is intentionally minimal: it has no visitor accounts, checkout, newsletter, contact form, advertising trackers, analytics service, or non-essential cookies. It publishes professional information that I choose to make public.

Data controller and contact

Data controller: Zachary Montague. Location: Illinois, United States. Privacy contact: LinkedIn. No separate data protection officer or local representative has been appointed for this personal site.

Scope

This policy applies to zacmontague.com, its public pages, public machine-readable resources, and the interactive terminal. It does not apply to LinkedIn, GitHub, hosting providers, or AI platforms that you reach through links. Those services control their own processing under their own notices.

Notice at collection

At or before collection, the categories that may be processed are: technical request data such as IP address, date and time, requested path, HTTP method, referrer, user agent, response status, and transfer size; information you choose to send in a LinkedIn message; and a browser sessionStorage flag used by the terminal. The purposes are to deliver the site, maintain security and reliability, operate the terminal, respond to professional inquiries, and publish the public profile. I do not sell personal information or share it for cross-context behavioral advertising. Hosting and security logs are kept according to the provider's operational and security retention practices; messages are kept only as long as needed for the purposes described below. This Privacy Policy is the detailed notice for this collection.

Information you provide voluntarily

If you contact me through LinkedIn, you choose what to share, such as your name, contact details, message, resume, or project context. I use that information to respond, evaluate a potential professional conversation, maintain related correspondence, and meet legal or recordkeeping needs. Do not send passwords, payment-card details, government identifiers, health information, client secrets, or other sensitive or confidential material through an ordinary public message.

Technical data from hosting

The hosting environment and reverse proxy may process technical request data such as IP address, date and time, requested URL, HTTP method, referrer, browser or device user agent, response status, and transfer size. The site uses this information for delivery, abuse prevention, security monitoring, troubleshooting, and reliability. The site does not use it to build advertising profiles or make decisions about visitors.

Public professional and machine-readable content

The site displays professional information that I intentionally make public, including work history, skills, public project descriptions, and public links. The same class of content is available at /llms.txt, /llms-full.txt, /data/prompt.json, and /data/terminal.json for search engines, AI systems, and site features. Crawlers may index that content as allowed by robots.txt. Requests for those resources may appear in hosting logs.

Cookies, sessionStorage, and browser cache

The site does not set non-essential cookies and does not use third-party analytics or advertising cookies. The interactive terminal stores one sessionStorage flag named linuxcowboy-boot-seen so its boot sequence does not repeat in the same browser tab. That flag remains on your device, is not sent to the site, and is cleared when the browser session ends. The site may request browser caching of public CSS, JavaScript, images, and JSON resources; that cache is not used for tracking or profiling. Because the site currently uses no non-essential tracking storage, there is no optional analytics or advertising consent choice to present. If that changes, this policy and any required consent mechanism will be updated before the change is published.

Clipboard and outbound links

When you click Copy prompt or an Ask AI action, the site may fetch /data/prompt.json and ask your browser to copy the prompt to your device clipboard. I do not receive or store clipboard contents. Ask AI actions open an external platform only after your click. LinkedIn, GitHub, and AI platforms may receive information about your visit or the information you submit to them under their own policies.

Legal basis and purposes

Where the GDPR or UK GDPR applies, the processing purposes and legal bases are: publishing and maintaining the public professional profile and machine-readable resources, based on legitimate interests in professional visibility and accurate representation; delivering the site and protecting it from abuse, based on legitimate interests and any applicable legal obligations; responding to a message or evaluating a requested professional conversation, based on steps at your request before a contract and legitimate interests; and running the terminal, clipboard, or outbound-link action you request, based on your action and, where required, consent.

Recipients and processors

Information may be processed by the hosting and infrastructure providers used to serve and protect the site; by LinkedIn if you use LinkedIn; by GitHub if you visit or interact with linked public code; and by an AI platform such as OpenAI/ChatGPT, Anthropic/Claude, Google/Gemini, xAI/Grok, or Microsoft/Copilot if you choose to open it. I do not sell personal information or share it for cross-context behavioral advertising.

International transfers

The site is operated from the United States. Hosting and other providers may process information in the United States or another country where they operate. The applicable provider's privacy notice and contractual transfer mechanism govern that processing. Where a law requires a transfer safeguard, the responsible provider must use the safeguard required for that transfer. Contact me if you need the current provider information for a specific privacy request.

Retention

This app does not maintain a visitor database. Hosting and security logs are retained by the hosting provider according to its operational, security, and legal requirements; I do not set a separate app-level log-retention period. LinkedIn correspondence is retained only as long as reasonably needed to respond, manage a professional relationship, resolve disputes, or meet legal obligations, then deleted or anonymized when practical. The sessionStorage flag lasts until the browser session ends. Public profile content remains available while I choose to publish it.

Security

I use reasonable technical and organizational measures appropriate to this small informational site, including HTTPS in production, restricted access to private files, security headers, method restrictions, least-privilege deployment, backups, and a published vulnerability-reporting contact at /.well-known/security.txt. No internet transmission or storage system is perfectly secure.

Your rights (GDPR and UK GDPR)

If GDPR or UK GDPR applies, you may have rights to access, correct, erase, restrict, object to processing based on legitimate interests, receive portable information where applicable, and withdraw consent where processing relies on consent. You may submit a request through LinkedIn. I may need to verify your identity and may have to retain limited information to document the request. You may also complain to the supervisory authority in the country where you live, work, or believe an infringement occurred, including the UK Information Commissioner's Office where relevant.

US state privacy rights

Residents of states with consumer-privacy laws may have rights to know or access, correct, delete, obtain a copy of, or limit certain uses of personal information, and in some states to opt out of sale, sharing, or targeted advertising. This site does not sell or share personal information for targeted advertising, and it does not use sensitive personal information for a separate purpose. Some laws apply only when a business meets statutory thresholds. Send a request through LinkedIn with the subject Privacy Request; I will not discriminate against you for exercising a right.

Sensitive information and children

The site is not designed to collect sensitive personal information, biometric data, precise location, health information, financial-account data, or government identifiers. Please do not send those categories through LinkedIn. The site is not directed to children under 13 in the United States or a higher minimum age required by local law. If I learn that a child provided personal information, contact me through LinkedIn so I can take appropriate steps to delete it.

Automated decision-making and profiling

This site does not use automated decision-making or profiling that produces legal or similarly significant effects. Ask AI links open external tools you choose; they are not operated by this site and are not used by me to make decisions about you.

Changes to this policy

I may update this policy when the site's data practices or legal obligations change. The Last updated date at the top identifies the current version. Material changes will be posted on this page before or when they take effect where required.

Contact

Privacy questions, rights requests, or a request for provider information may be sent through LinkedIn.

Contact: LinkedIn