Privacy Policy

Guerra Co. is operated by Spencer Guerra, a sole proprietor based in Texas, USA. The site is a personal portfolio — there are no products for sale, no user accounts, and no contact form.

Questions about this policy or your data? Email spencer@guerra.co.

When you load a page, the hosting infrastructure (Firebase Hosting) automatically records standard server-log information: your IP address, the user-agent string your browser sends, the page URL you requested, the referring page, and a timestamp. These logs are retained at Firebase’s standard retention and are used only for security, abuse prevention, and basic operations.

Hotjar (see Section 03) collects anonymous behavioral data: device, browser, screen size, mouse movement, scrolling, and clicks. Text input is suppressed and IP addresses are anonymized.

I do not collect names, email addresses, or any other personal information unless you choose to email me directly.

Three third-party services run on this site:

Hotjar (site ID 2553661) records anonymous session replays and heatmaps so I can understand how people use the site. You can opt out of Hotjar across every site that uses it at hotjar.com/legal/compliance/opt-out.

Google Fonts loads typography from fonts.googleapis.com and fonts.gstatic.com. When your browser fetches a font, Google receives standard request metadata (IP address, user-agent, referring page).

Firebase Hosting (Google) serves the site and produces the server logs described above.

I do not sell or share data, run ads, or use any tracking services other than the three listed here.

One value is kept in your browser’s localStorage: guerra_boot_ts, a timestamp used to suppress the intro animation if you’ve recently visited. It contains no personal information.

One page on this site, /helium/, is password-protected and shared only with selected recruiters. After a successful login, that page sets one HttpOnly session cookie, __session, that expires after 7 days. The password is verified server-side and is never stored or logged.

Hotjar and Google Fonts may set their own cookies; see their policies for details. You can clear cookies and localStorage for this site at any time from your browser settings.

You can opt out of Hotjar at hotjar.com/legal/compliance/opt-out. You can clear localStorage and cookies for this site at any time from your browser settings. Most browsers offer a global “Do Not Track” or “Global Privacy Control” signal, which the third parties listed above honor according to their own policies.

To request a copy of any data that may relate to your visits, ask for it to be corrected, or ask for it to be deleted, email spencer@guerra.co.

If you are a California resident, you have the following rights regarding personal information collected through this site:

Right to know — request the categories and specific pieces of personal information collected about you.

Right to delete — request deletion of personal information collected from you.

Right to correct — request correction of inaccurate personal information.

Right to opt out of sale or sharing — Guerra Co. does not sell or share personal information for cross-context behavioral advertising.

Right to limit use of sensitive personal information — Guerra Co. does not collect sensitive personal information.

Right to non-discrimination — you will not receive different service for exercising these rights.

Categories collected in the last 12 months: identifiers (IP address) and internet/network activity (pages visited, referrer, user-agent, behavioral interaction data via Hotjar). Sources: directly from your browser. Business purposes: site operation, security, abuse prevention, analytics. Disclosed to: the third-party processors listed in Section 03 (Hotjar, Google Fonts, Firebase Hosting).

To exercise any of these rights, email spencer@guerra.co with the subject “CCPA Request” and a description of your request. I will respond within 45 days. You may use an authorized agent; I may verify the agent’s authority and your identity through the email address used to make the request.

If you are in the European Union, European Economic Area, United Kingdom, or Switzerland, the following applies:

Controller — Spencer Guerra, sole proprietor, Texas, USA. Contact: spencer@guerra.co.

Legal bases for processing — Server logs and security data are processed under legitimate interest (Art. 6(1)(f) GDPR) in operating and securing the site. Hotjar analytics are processed under legitimate interest in understanding site usage; you may object at any time using the Hotjar opt-out linked in Section 05. The __session cookie on /helium/ is strictly necessary for the requested service (logging into the gated page).

Your rights — access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent (where processing is based on consent). To exercise any right, email spencer@guerra.co with the subject “GDPR Request.”

International transfers — Data processed by Hotjar (Malta, EU), Google Fonts (Google, USA/global), and Firebase Hosting (Google, USA/global) may be transferred outside the EEA/UK. These transfers rely on the providers’ Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

Retention — Server logs are kept for the standard retention period of Firebase Hosting. Hotjar data is retained per Hotjar’s policy. The __session cookie expires after 7 days. The guerra_boot_ts localStorage value persists until you clear it.

Right to lodge a complaint — you may complain to your local data protection supervisory authority. UK residents may complain to the Information Commissioner’s Office (ico.org.uk).

Spencer Guerra
spencer@guerra.co

If this policy changes, the effective date at the top of this page will be updated.