Privacy Policy
Last updated: 25 October 2026
This page describes how this personal portfolio website handles information. It reflects how the site actually works today. It is not legal advice. Items that still need an owner decision are called out explicitly.
Who operates this site
This is a personal portfolio operated by Mohamadreza Rezaei, based in Tehran, Iran. Contact email is published on the site (portfolio personal info). There is no separate registered company name stated in the product for this site.
What information is involved
Depending on how you use the site, information may include: • Contact form: your email address and message text • Optional authentication: Iranian mobile number and one-time codes for login/password flows • Preference cookies: theme, language, and announcement-banner dismissal • Auth session cookies (when you sign in): token and basic user profile stored in the browser • Usage telemetry via Vercel Analytics and Speed Insights • Technical requests when fonts or content APIs load
Contact form
The contact form collects only an email address and a message. Submissions are sent to an external API configured via NEXT_PUBLIC_API_URL. Fields that are not needed for a reply (phone, address, date of birth, etc.) are not requested.
Authentication
Optional sign-in uses phone OTP and/or password through the same external API. Session data is stored in browser cookies that JavaScript can read (not HTTP-only): auth token, user profile JSON, remember-me flag, and short-lived OTP flow cookies. SameSite=Lax is used; Secure is enabled in production for auth cookies.
Cookies and similar storage
Functional preference cookies: portfolio_theme, portfolio_language, portfolio_banner_dismissed, portfolio_analytics_consent, and the locale cookie used by next-intl (NEXT_LOCALE). Auth cookies (when signed in): auth_token, auth_user, auth_remember, auth_otp_token, auth_otp_mobile. Preference and session cookies keep the site usable; analytics scripts are optional and consent-gated.
Analytics and performance
Vercel Analytics and Vercel Speed Insights load only after you accept optional analytics in the consent notice. If you reject (or have not chosen yet), those scripts are not loaded. Your choice is stored in the portfolio_analytics_consent cookie for up to about one year. Essential preference cookies (theme, language, banner) are not gated by this choice.
Portfolio content (Supabase)
Public portfolio content (projects, experience, etc.) is loaded from Supabase using a publishable (anon) key intended for public read access. That path is for published content, not for storing your contact messages.
Fonts
Latin UI fonts are loaded via next/font. Persian Vazirmatn is loaded from the Arvan Cloud font CDN, which means the browser requests that third-party host when the page loads.
Third-party services
Services that may receive technical or personal data when you use the site: • External application API (contact + auth) • Supabase (public portfolio content) • Vercel Analytics and Speed Insights • Arvan Cloud font CDN • MSW mock API in local development only A living inventory is kept in the project docs (third-party-services).
Retention
[Owner input needed] How long contact messages and auth accounts are kept is determined by the external API / operator policy and is not hardcoded in this frontend. Preference cookies may last up to about one year; auth session cookies typically up to 7 days (remember-me longer); OTP cookies are short-lived (~5 minutes).
Your choices
You can accept or reject optional analytics in the consent notice. Clearing site cookies in your browser signs you out, resets preferences, and shows the consent notice again. You can avoid sending a contact message or creating an account. You can email the address published on the site about data held in the contact/auth backend.
Children
This portfolio is aimed at professional contacts and is not directed at children. Do not submit personal information about a child through the contact form.
Changes to this policy
If the site’s data practices change (for example, new tracking or new form fields), this page should be updated to match the real behavior.
Contact about privacy
Use the contact form or the email address shown in the site footer / about section. Prefer email for privacy questions so there is a clear reply channel.
This policy describes technical behavior of the site. Retention periods for messages and accounts are decided by the backend API operator and are not inventively stated here. If you need a formal legal review for a specific jurisdiction, consult a qualified professional.