Shawn Ng
Log inJoin me

Privacy Policy

Last updated: October 21, 2026

This is the personal blog of Shawn Ng (“we”, “us”). This policy explains what data we collect when you visit https://shawnng.com, why we collect it, and the choices you have. We aim to collect as little as possible.

Summary

  • We do not sell your data, and we do not run any tracking beyond what is described below.
  • Our own analytics record your visits. If you are signed in to a member account, they are linked to that account by your name, email address and profile photo. We use this to run and secure the site and to understand how it is used, never for advertising, and we never sell it.
  • If you create a member account, we keep your account details and a record of your signed-in sessions so we can run the account and protect it from abuse.
  • We show ads via Google AdSense. In the EEA, UK, and Switzerland we ask for your consent before personalized advertising cookies are used.
  • We only email you if you ask us to, and you can unsubscribe at any time.

Analytics

We use Google Analytics to understand aggregate traffic (such as page views, referrers, and approximate geography). Google Analytics sets cookies and collects device identifiers and IP addresses on Google’s behalf; we see only aggregated reports and do not use analytics data to identify individual visitors. You can opt out with the Google Analytics opt-out browser add-on or by blocking analytics cookies in your browser.

We also run signallark, our own first-party analytics system, on infrastructure we control. For each visit it records the pages you view, the page that referred you, the query parameters in the page address (leaving out any that look like passwords or keys), your IP address, the approximate location derived from it (country, region, and city), the network it belongs to (including whether it is a known VPN or Tor exit), and your browser user-agent, from which it reads the browser, operating system, and device type. It also notes technical problems on the page, such as script errors and clicks that get no response. It sets no cookies. Visits are grouped by an identifier computed from your IP address and user-agent that changes every day, so on its own it cannot follow you from one day to the next, and it never follows you across other sites. This data is kept for up to two years. Nothing it collects is shared with a third party.

If you are signed in to a member account, the site also tells signallark who you are: your name, your email address, your profile photo (the one your Google account provides, if you sign in with Google), your membership plan, whether you have confirmed your email address, and a one-way SHA-256 hash of your email address that serves as your member ID. They are linked to every visit you make while signed in, so we can see which member is reading what and how members use the site over time. When you sign in or create an account, the site also records that it happened and how (with a password, an emailed link or Google); a short-lived cookie carries that to the next page, which deletes it at once. We use this to understand how members use the site and to protect accounts, never for advertising, and none of it is shared with a third party.

Advertising

We use Google AdSense to display ads. Google and its partners may use cookies and similar technologies to serve ads and, with your consent, to personalize them based on your prior visits to this and other sites.

  • In the EEA, UK, and Switzerland, we use a Google- certified consent management platform to ask for your consent before any personalized-advertising cookies are set. You can choose to consent, to refuse, or to manage your choices, and you can change your decision at any time via the consent controls on the site. If you refuse, you may still see non-personalized ads.
  • You can review and control Google’s use of advertising cookies at Google My Ad Center and learn more in Google’s advertising policy. Google’s handling of data is governed by the Google Privacy Policy.

Mailing list

You can subscribe to updates while signed in to a member account, with one click, or by ticking the newsletter box when you create an account. If your email address is already confirmed (for example because you signed in with Google), you are subscribed at once; otherwise the email that confirms your account also confirms your subscription. We use your address solely to tell you when a new post or video is published.

  • We keep your email address, how and when you subscribed, and the IP address you subscribed from, as a record of your consent.
  • Subscriber addresses are stored on Astris, the publishing platform this site runs on (see "Hosting and server logs" below). Emails are sent through Sendoramo, our own email service, which delivers them with Microsoft Azure Communication Services.
  • Every email includes an unsubscribe link, and supports one-click unsubscribe in email apps that offer it; you can opt out at any time. When you unsubscribe, we stop emailing you and keep your address with the date you left, so that your choice is respected. To have it removed completely, email us.
  • We never sell or share your email address, and we do not use it for anything other than these notifications.

Member accounts

You can create a free member account with your email address and a password, or by signing in with Google. For each account we keep:

  • your email address and name (the first name you give on the sign-up form, or the name your Google account provides), and the address of your Google profile photo if you signed in with Google;
  • how you sign in. For a password account we keep only a salted hash of your password (Argon2id), never the password itself; for a Google sign-in, the identifier Google gives your account, so we recognise you next time;
  • your membership plan, the date the account was created, when you confirmed your email address, and when you last signed in;
  • a record of each signed-in session: when it started and was last used, how you signed in, and the IP address and user-agent of the device. Each session ends after at most 180 days, sooner after 30 days without a visit or when you sign out, and its record is deleted 30 days after it ends;
  • for a short while, counts of sign-in and sign-up attempts per IP address and email address, to slow down automated attacks (deleted after 24 hours).

We use this to run your account, to keep you signed in, and to spot accounts created or used by automated scripts. If you tick the newsletter box when you create an account, your address is also added to the mailing list described above. Account data is stored on Astris and kept for as long as the account exists. Accounts created before October 2026 were moved to Astris when the site moved: passwords came across only as their existing scrypt hash, which is replaced with an Argon2id hash the next time you sign in. On your account page you can change your name and password and sign out on every device. To delete your account and its data, email us at hello@shawnng.com; there is no self-service delete yet.

Hosting and server logs

The site runs on Astris, a publishing platform we operate, hosted on Microsoft Azure (Azure Container Apps and Azure Database for PostgreSQL, in the central United States). Every request passes through Cloudflare, which serves and caches the site and protects it against abuse; to do that, Cloudflare processes standard technical request data such as your IP address and browser type. Our own servers log each request’s method, path (without the query string), status and timing, but not your IP address, and keep these logs for 30 days.

Cookies

We do not set tracking cookies of our own. Our cookies are for signing in:

  • astris_cs keeps you signed in to a member account (up to 180 days; you are signed out sooner after 30 days without a visit);
  • astris_oidc_bind on this site and astris_oidc_m on auth.astris.si (Astris’s sign-in service) hold a Google sign-in while it is in progress (10 minutes);
  • astris_signin tells the next page that you have just signed in or created an account, and how (5 minutes; the page reads it, reports the sign-in to signallark as described above, and deletes it at once).

The site also keeps a few things in your browser’s local storage so pages show the right state straight away: your colour theme; when you are signed in, your name, email address, plan and profile photo address (removed when you sign out); and short-lived notes, such as whether to show the welcome tour or that you asked to subscribe while creating an account. Local storage never leaves your device. Other cookies come from Google Analytics and Google AdSense (for advertising, subject to your consent as described above) and, where applicable, from the tool that remembers your consent choice. signallark is cookieless.

Where the GDPR or UK GDPR applies, we rely on the following legal bases: consent for personalized advertising and for sending you mailing-list emails; performance of a contract for running your member account if you create one; and our legitimate interests in running, securing, and understanding use of the site. That last basis covers our first-party analytics, including linking signed-in visits to your member account as described above, which we use to understand how members use the site and to protect their accounts, not for advertising or marketing profiles. You can object to it by emailing us.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to object to or restrict its processing, and to withdraw consent at any time. To exercise any of these rights, email us at hello@shawnng.com. You also have the right to lodge a complaint with your local data protection authority.

International transfers

Some of our service providers (including Google, Microsoft, and Cloudflare) are based in or process data in the United States and other countries. Where personal data is transferred internationally, those providers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Children

This site is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16.

Changes

We may update this policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be reflected on this page.

Contact

Questions about this policy or your data? Email hello@shawnng.com.

← Back to the blog