Privacy Policy

Effective Date: 8 de Junho de 2026

Introduction

This Privacy Policy describes how Jackson Barreto ("we," "our," or "us") collects, uses, and protects your personal information when you visit our website www.jacksonbarreto.com (the "Site").

Data Controller: Jackson Barreto
Contact: contato@jacksonbarreto.com

First-Party Analytics

We operate our own first-party analytics system to understand how visitors use the Site. The data we collect is our own, is not sold, and is not used to follow you across other sites. We do not use device fingerprinting, we do not call any external GeoIP API from your browser, and we never store or log your IP address in clear.

What we collect

Depending on your consent choices, we may collect:

Page views
Clicks
Section views
Engagement time (only when you consent to internal statistics)
Referrers (how you arrived at the Site)
Coarse device, browser and operating system information
Approximate country (resolved server-side, never your exact IP)
Locale/language (from your browser's navigator.language, aggregated)

Even without optional consent, the Site still collects aggregated, non-identifying technical metrics for security, performance and basic internal statistics.

Basic Mode

Basic mode applies when you only keep "Necessary" preferences. In this mode we collect aggregated, anonymous technical metrics only: page views, clicks, section views, referrer, locale/language, coarse device/browser/operating system and approximate country (resolved server-side). Basic mode does not create a persistent visitor id, does not create a session id, and does not set any analytics cookie or analytics localStorage item. "Necessary" does not mean zero collection: the aggregated, non-identifying metrics above are still collected.

Enriched Mode

In addition to basic mode, when you consent to "Internal Statistics", we create a first-party visitor_id (UUID v4) stored in localStorage['analytics_visitor_id'] and a session_id (UUID v4) stored in sessionStorage['analytics_session_id'] . These ids are used only for revisit and session metrics, are limited to this site, and are revocable. Revoking consent clears the ids and the in-memory event buffer.

Google Analytics (separate, active)

We also use Google Analytics, a separate third-party web analytics service provided by Google LLC. Google Analytics is active on this Site, but only after you consent to the "Google Analytics" option in the consent banner. It is a separate channel and is not the source of our own analytics; the admin dashboard reads only our own PostgreSQL database.

The public Google Analytics Measurement ID is G-CYYRZG16Y9.

Google consent mode keeps analytics_storage denied until you consent. The Google Analytics script is not present in the initial page HTML; it is injected at runtime only after consent. Page view events are sent to Google only after consent, and on single-page application navigation we send manual page_view events.

The _ga and _ga_* first-party cookies are set on your device only after you consent to Google Analytics. If you later revoke consent, we deny analytics_storage again and make a best-effort attempt to expire those cookies, which stops Google Analytics for this Site.

Data collected by Google Analytics is transmitted to and stored by Google on servers in the United States, and Google may process it there. Google may also transfer this information as required by law or for processing on Google's behalf.

For more information on Google's privacy practices, see https://policies.google.com/privacy

You can opt out of Google Analytics using the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

GeoIP (server-side only)

Your approximate country is resolved on the backend from trusted reverse-proxy/CDN headers, a local MaxMind MMDB file (optional; the Site works without it), or a configured backend external provider. Your IP address is never persisted in clear, never logged, and never sent in the event payload. An HMAC of the IP is used only as an in-memory cache key. There is no browser-side external GeoIP call.

Retention

First-party analytics events are retained for 90 days by default (configurable via ANALYTICS_RETENTION_DAYS) and then automatically purged by a backend retention service. In production, a retention value of zero or less is rejected. Revoking consent stops future collection but does not delete already-stored data: that data is kept for the remainder of the retention window and is deleted on request via the contact email.

Consent

Our cookie consent banner offers three granular, equal-weight options: "Necessary" (always on), "Internal Statistics" and "Google Analytics". You can accept all, save custom preferences, or reject the optional ones with the same weight; there are no dark patterns.

Revoking "Internal Statistics" clears the visitor_id and session_id from storage and stops enriched collection; any not-yet-sent enriched events are dropped. Revoking "Google Analytics" denies analytics_storage again and makes a best-effort attempt to expire the _ga and _ga_* cookies. Already-stored first-party data is retained up to the retention window described in the Retention section and is deleted on request via the contact email.

Your choices are stored in localStorage['cookie-consent'] and are revocable at any time from the banner.

Storage on Your Device

cookie-consent - Your consent preferences (necessary, always stored)
analytics_visitor_id - First-party visitor id in localStorage, created only after you consent to Internal Statistics
analytics_session_id - First-party session id in sessionStorage, created only after you consent to Internal Statistics
_ga / _ga_* - Google Analytics first-party cookies, set only after you consent to Google Analytics
jackson-website-auth - Admin authentication (admin use only)

Other Third-Party Services

ORCID

Our Site displays academic publications from the ORCID public profile (https://orcid.org/0000-0002-4064-8587). This data is fetched from ORCID's public API and does not involve any tracking of Site visitors. No cookies are set by ORCID. For more information, see ORCID's privacy policy.

Supabase

We use Supabase to store website content (articles, media), handle contact form submissions, and provide admin authentication. Supabase stores data on servers in the European Union. For more information: https://supabase.com/privacy

Contact Form

When you submit our contact form, we collect:

Your name
Your email address
Your message

This information is used solely to respond to your inquiry and is stored securely in our database. We retain contact form submissions for 12 months to maintain a record of our communications. Your data will not be shared with third parties except as necessary to respond to your message.

Your Privacy Rights

You have the right to:

Opt-out: Click "Necessary Only" to disable all analytics tracking
Access: Request a copy of data we've collected about you
Deletion: Request deletion of your analytics data
Portability: Receive your data in a machine-readable format
Rectification: Correct inaccurate data
Object: Object to processing of your data

How to Exercise Your Rights

To manage cookies: Use our cookie consent banner
To delete your analytics data: Contact us at contato@jacksonbarreto.com
For other requests: Contact us at contato@jacksonbarreto.com

Google Analytics Opt-Out

Install the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

International Data Transfers

Google Analytics: Data is transferred to and stored on Google servers in the United States.

Supabase: Data is stored on servers in the European Union.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: contato@jacksonbarreto.com
Website:www.jacksonbarreto.com