privacy policy.

last updated 19 October 2026

This page says what markjborg.com does with information, taken from how the site is built. I am Mark Julian Borg. I live in Malta. Malta is in the EU, so the GDPR applies. I am the person responsible for this site.

There is no account, no checkout, and no mailing list. The site is a static portfolio hosted on Vercel. While the coming-soon lock is on, it covers the home page only. This page and the terms of use stay open.

what stays on this device

A few things are saved in your browser, on that device only. The site does not send them to a server.

In localStorage:

• mjb.os.icons — where you dragged the desktop icons
• mjb.os.snap — whether snap to grid is on
• mjb.os.note — the sticky note, including whatever you type
• mjb.os.unit — whether the weather label says °C or °F
• mjb.os.preview — only if you visit with ?preview=mjb, so the coming-soon lock stays off later. ?preview=off removes it

In sessionStorage, mjb.os.booted remembers that the boot screen already played in this tab. Closing the tab clears it. Reboot from the desktop menu clears it too.

Window positions are not saved. The lock screen does not store what you type. That field does not check a password, and it does not send the text anywhere.

The share button copies a link to your clipboard. The site does not receive a copy.

Clearing this site’s data in your browser deletes the saved items.

cookies

The code on this site does not set cookies, and it does not read document.cookie.

analytics and speed

The home page loads two scripts from this same site, for Vercel:

• /_vercel/insights/script.js — Vercel Web Analytics
• /_vercel/speed-insights/script.js — Vercel Speed Insights

This page and the terms page do not load those scripts. I do not add custom analytics events, and I do not run a separate analytics vendor.

Vercel describes Web Analytics as working without cookies. It says visitors are identified by a hash of the request, discarded after 24 hours, so it is not meant to follow you from one day to the next or onto other websites. With a page view, Vercel says it may store the time, the page address, a filtered query string, the referrer, a coarse location, the operating system, the browser, and the device type.

Vercel describes Speed Insights as performance numbers that are not tied to a person or an IP address. With a measurement, Vercel says it may store the page, country, browser, device type, operating system, network speed, and web-vital timings such as how long the page took to paint.

hosting logs

Vercel hosts the site and answers each request. Hosting logs can include the page requested, the time, the response, and connection details such as IP address and browser. This site does not add its own visitor log, and it does not choose how long Vercel keeps those logs.

The host also sends a permissions policy that tells the browser not to allow camera, microphone, location, payment, or USB for this site. The clock shows Valletta time from your device. It does not ask for your location. The weather widget is placeholder text, not a weather service.

contact

The contact window does not post the form to a server. Send opens an email in your own mail app, addressed to me, with the name, email, project type, and message you typed. If you send it, it is an ordinary email, and I use it to reply about the work. If you close it without sending, the site has not kept a copy.

The address is assembled by the script. It is not written out in the page. The same link is on the lock screen, the résumé, and here: markjborg [at] gmail [dot] com.

photos

The photos window starts with image files shipped with the site. Instagram is not embedded. There is no Instagram script, no Instagram cookie, and the browser is not given Instagram’s picture address.

If an Instagram token is configured on the server, opening the window asks this site (/api/instagram) for a recent list. The server calls Instagram’s API, then serves the pictures itself at /api/ig-img. The token stays on the server. It is not put in the page or in git. If that request fails, or there is no token, you still see the shipped photos.

The “more on Instagram” link leaves this site.

My own display polls /tvs/smiirl_facebook_followers.php. That endpoint returns only the public Facebook page follower count, and it handles no visitor data.

music

The player plays three audio files stored on this site. Nothing is streamed from a music service, and the site does not save what you play. Your device’s media controls may show the track title and artist.

other sites

Some project windows load another site in a frame:

• playdate games — playdategames.com
• btc21 — btc21.academy
• planet boop — planetboop.com
• blackcat — blackcat-mainsite.vercel.app

The frame does not send this page’s address as a referrer. Once loaded, that site can run its own scripts and follow its own rules. I do not control that from this page.

ECI (eci.edu.mt) is a link only. That site refused to be shown in a frame, so the window offers a button that opens it in a new tab.

The desktop also links to X, Instagram, and LinkedIn, and the résumé links to planetboop.com, playdategames.com, btc21.academy, and bitcoinhud.com. For a normal link, the host’s referrer policy lets the other site see that you came from markjborg.com, not the full address with a query string.

your rights

You can ask me to access personal data I hold about you, to correct it, or to erase it. You can also complain to Malta’s Information and Data Protection Commissioner (IDPC), at idpc.org.mt.

Most of what this site stores is on your device, or in Vercel’s hosting and analytics, not in a database I run. There is no customer account to look up. Email me and say what you want done. For the items that live only in your browser, clearing this site’s data removes them without an email.

changes

If I change this text, I will change the date at the top. The wording on this page is the current one.