Privacy Policy
This Privacy Policy covers what Ryan Yannelli ("we," "us," or "our") collects when you visit https://ryanyannelli.com (the "Site"). The Site is a personal portfolio operated from Westchester County, New York. It uses no tracking cookies, no advertising scripts, and no third-party identifiers. The one analytics tool in use does not see anything personally identifying about you.
Who This Covers
The Site is operated by Ryan Yannelli from Westchester County, New York, United States. This policy applies when you visit the Site, submit the contact form, or email the address published here.
It covers only https://ryanyannelli.com. It does not cover Nextvisit AI or any other site, product, or service that is not this Site, even if this Site links to them.
What We Collect
The Site uses Plausible Analytics, a cookieless analytics service. Plausible records aggregate, anonymous data about each page view: the URL visited, the referring source, the country (derived from IP, not stored), the browser, the operating system, and the device type. It does not use cookies, does not store IP addresses, and does not build a profile that can identify you across visits or sites.
If you submit the contact form, we collect the name, email address, and message you send so we can reply. If you email us directly, we collect whatever you put in that message, including your email address. That inbound mail is handled by Formspree and a Gmail inbox, as described under Third-Party Services.
Cloudflare, which hosts the Site, may process technical request data needed to deliver and secure it: IP address, date and time, requested URL, user agent, and referrer. We do not use that data to identify you or to advertise.
The Site does not use:
- Tracking cookies of any kind
- Advertising scripts, retargeting pixels, or ad-network identifiers
- Google Analytics, Google Tag Manager, Facebook Pixel, or any similar tool
- Cross-site or fingerprinting techniques
- Payment information, government identifiers, account passwords, precise geolocation, or visitor biometric data
How We Use What We Collect
- Aggregate analytics data tells us what content people read, which is used to decide what to write more of.
- Contact form submissions and inbound email are used to reply to the message and nothing else. We do not add you to a list, and we do not use that mail for marketing.
- Technical request data is used to deliver the Site, keep it up, and respond to abuse or security incidents.
We do not sell personal information. We do not share personal information for targeted advertising or cross-context behavioral advertising. We do not use personal information for automated decision-making or profiling that produces legal or similarly significant effects.
Third-Party Services
We use a short list of processors to run the Site. They receive only what they need for that job. We do not sell your information to them.
Plausible Analytics
Plausible Analytics is hosted in the European Union. Plausible's own documentation states it is GDPR, CCPA, and PECR compliant. Because it does not use cookies and does not collect personal data, no consent banner is required. You can read their privacy stance for the full technical details.
Cloudflare
The Site is hosted on Cloudflare Workers. Cloudflare collects certain technical information necessary to deliver and secure the Site, and may process that data at edge locations outside New York. See Cloudflare's Privacy Policy for details.
Formspree and email
The contact form is processed by Formspree, which routes submissions to a Gmail inbox I read myself. Formspree processes the name, email, and message you provide. Direct email to ryanyannelli@gmail.com goes to that same inbox. Their handling is described in Formspree's privacy policy and Google's privacy policy.
Nightscout
The home page shows a live trace of my own blood glucose, and an instrument for insulin still acting and carbohydrate still absorbing (IOB and COB). Both feeds come from a Nightscout server I run myself. Nightscout is open-source software for viewing continuous glucose monitor and Loop data. What you see on first load was fetched when the Site was built and baked into the page.
After that, the page refreshes both instruments from /api/glucose and/api/loop on this domain. The on-board butterfly reads both: insulin and carbs from Loop, and the same sensor-glucose series as the trace, so the three can be compared on one time axis. On the Cloudflare deployment, those endpoints fetch from the Nightscout server, keep only the fields each instrument plots (timestamp and sensor value; timestamp, insulin on board, and carbs on board), and cache the result for five minutes. Pump identifiers and other device metadata are stripped. Your browser does not contact the Nightscout server directly, and the request carries nothing about you beyond a normal HTTP request to this Site. The Loop data is mine and is published here by my own choice; it is not visitor data and is not associated with anyone reading the page.
Cookies and Similar Technologies
We do not set tracking, advertising, or analytics cookies. We do not use local storage, pixels, or similar techniques to identify you across visits.
Cloudflare, as the host, may set strictly necessary cookies for security or bot management. Those cookies are not used here for advertising or cross-site tracking. Because the Site does not use non-essential cookies, there is no cookie-consent banner.
New York Residents
The Site is operated from New York. As of the date above, New York has not enacted a comprehensive consumer privacy statute comparable to California's CCPA. New York residents still have the following.
Reasonable safeguards and breach notice (SHIELD Act)
The Stop Hacks and Improve Electronic Data Security Act (N.Y. Gen. Bus. Law §§ 899-aa and 899-bb) requires any person who owns or licenses computerized data that includes the "private information" of a New York resident to keep reasonable administrative, technical, and physical safeguards, and to notify affected residents (and, when the statute requires it, the New York Attorney General and consumer reporting agencies) if that private information is acquired or accessed without authorization.
We do not ask you for Social Security numbers, driver's licenses, account passwords, or biometrics. The information we typically hold is a name, an email address, and a message you chose to send. If a message you send includes private information as the SHIELD Act defines it, or if we otherwise come to hold such information, we will treat it under those rules: keep safeguards appropriate to a personal site of this size, and give the notices the statute requires if a breach occurs.
Access, correction, and deletion
You may email us to ask what personal information we hold about you, to correct it, or to delete it. We honor those requests without requiring you to invoke a specific statute. See Contact.
No sale, no targeted advertising
We do not sell personal information and we do not share it for targeted advertising. There is nothing to opt out of in that respect.
Minors
The New York Child Data Protection Act is addressed under Children's Privacy. This Site is not directed to anyone under 18.
Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), may grant you the rights below. We honor these requests whether or not we meet the CCPA's "business" thresholds.
Right to Know
You may request information about the categories and specific pieces of personal information collected about you, the sources, the purposes, and the categories of third parties it is disclosed to. The Site collects no information that personally identifies you outside of messages you initiate yourself (the contact form or direct email). Technical request data processed by the host is described above. Aggregate Plausible analytics are not personal information we can tie to you.
Right to Delete
You may request deletion of any personal information we hold. For contact form submissions or email, write to ryanyannelli@gmail.com and we will delete the message and any related correspondence, and ask processors to do the same where they hold a copy, unless a narrow legal exception applies.
Right to Correct
You may request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing
We do not sell personal information, and we do not share personal information with third parties for targeted advertising or any similar purpose. There is nothing to opt out of in that respect.
Right to Limit Use of Sensitive Personal Information
We do not collect sensitive personal information from visitors as that term is used in the CPRA. Glucose readings on the home page are the operator's own published data, not visitor data.
Right to Non-Discrimination
We will not discriminate against you for exercising any privacy right.
How to submit a request
Use either method under Contact. If someone submits a request on your behalf, we will need enough to verify both identities before we act. We aim to respond within 45 days.
Other U.S. State Privacy Rights
Several other states have comprehensive privacy laws that, where they apply, give residents rights to know, correct, delete, and opt out of sale or targeted advertising. If a law that applies to us gives you additional rights, contact us and we will honor them. Because we do not sell or share personal information for targeted advertising, opt-out rights of that kind have no additional effect here.
Global Privacy Control (GPC)
We honor Global Privacy Control signals. The Site does not sell or share personal information for cross-context behavioral advertising, so there is no extra behavior for the signal to turn off.
Data Retention
Plausible retains aggregate analytics data indefinitely; no personal identifiers are stored, so retention is not tied to an individual. Contact form submissions and inbound email are retained in that inbox for as long as the conversation is active, then kept only as long as needed to finish the correspondence or meet a legal obligation. Email us to request earlier deletion. Technical logs held by Cloudflare follow Cloudflare's retention for security and delivery.
Data Security and Incidents
We implement reasonable administrative, technical, and physical safeguards appropriate to a personal website of this size and to the limited personal information we hold. That includes HTTPS, security headers, restricting who can read the inbox, and using established processors rather than running our own mail or analytics stack. No method of internet transmission or storage is fully secure, and we make no claim of absolute protection.
If we become aware of unauthorized access to or acquisition of personal information we hold, we will investigate, take steps to contain it, and notify affected people and regulators when the law (including the New York SHIELD Act) requires it.
Children's Privacy
The Site is a personal portfolio about software and Type 1 diabetes advocacy. It is not directed to children or teens, and we do not have actual knowledge of any visitor under 18. We do not knowingly collect personal information from anyone under 18. We do not sell the personal information of anyone, including minors.
That position is intended to satisfy the federal Children's Online Privacy Protection Act (under 13) and the New York Child Data Protection Act (under 18; N.Y. Gen. Bus. Law §§ 899-ee et seq., effective June 20, 2025). If you believe we have information from someone under 18, email us. We will delete it and instruct processors that hold a copy to delete it as well.
International Visitors
The Site is operated from the United States and hosted on Cloudflare's network. Information you submit may be transferred to, stored, and processed in the United States and in other countries where our processors operate, including the European Union (Plausible). Those places may not provide the same legal protections as your home country.
If you are in the European Economic Area, the United Kingdom, or Switzerland, you may have additional rights under applicable law, including to access, correct, delete, or restrict personal data we hold, and to lodge a complaint with your supervisory authority. Contact us to exercise those rights. The lawful bases we rely on, where those laws apply, are the legitimate interest of operating and securing a personal website, and responding to a message you chose to send.
Changes to This Privacy Policy
We may update this policy from time to time. The "Last updated" date at the top of the page is the notice of the current version. Review it periodically. If a change is material, we will also say so on the Site. We do not have a visitor mailing list, so we cannot email every reader.
Contact
Questions about this policy, or requests to know, correct, or delete personal information:
- Email: ryanyannelli@gmail.com
- Contact form: https://ryanyannelli.com/contact
We will need enough information to find the message, usually the email address you used. We aim to respond within 45 days. New York law governs this policy, except where a mandatory consumer-protection law of your residence applies.