Cookie Policy
The cookies and browser storage this Site uses, why, for how long, and how to control them.
Version 1.0 · Last updated: 2 October 2026 · Dallas, Texas, United States
1. What This Policy Covers
This Cookie Policy explains how Hema Sai Mallampati ("we", "us") uses cookies and similar browser storage technologies on https://www.hemasai.com (the "Site"). Cookies are compact text files stored on your browser when visiting a website, while local storage and session storage persist configuration preferences client-side. This policy provides transparent disclosure of all storage mechanisms utilized by this site.
2. How We Categorize Cookies & Storage
Storage falls into three groups by necessity. The inventory below also marks storage that exists only because you asked for something (a translation, a kept chat) and storage used only by administrators.
Strictly Necessary
Essential for secure operation, CSRF protection, admin authentication, abuse mitigation, and storing your consent selections. These cannot be disabled.
Functional
Remembers your visual and accessibility preferences, such as Dark Mode or Light Mode theme selection, across browser sessions.
Analytics
When enabled, the site sends first-party interaction events to our own AWS API. No advertising or third-party analytics is involved. Section 4 describes the analytics data. The analytics record stores keyed address-derived identifiers instead of a readable network address. Security processing is described in the Privacy Policy.
3. Comprehensive Cookie & Storage Inventory
Every cookie and browser storage key the Site sets. Opt-in analytics stores nothing in your browser; it is described in section 4.
| Category | Key / Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|---|
| Strictly necessary | cookieConsent | This site · localStorage | Your cookie choices, so they are respected on later visits. | Until you change them or clear site data |
| Strictly necessary | __Host-portfolio_csrf | This site · cookie (HttpOnly, Secure) | Protects the contact and download forms, and administrator actions, against cross-site request forgery. | 1 hour |
| Strictly necessary | portfolio_dismissed_event_popup | This site · sessionStorage | Remembers that you closed the upcoming-event popup, so it does not reappear on every page. | Until the tab closes |
| Functional | theme | This site · localStorage | Your light or dark mode choice. | Until changed, or functional consent is withdrawn |
| Functional | accessibilitySettings | This site · localStorage | Accessibility preferences such as contrast and text size. | Until changed, or functional consent is withdrawn |
| Functional | translationNoticeAcknowledged | This site · localStorage (functional consent) or sessionStorage (otherwise) | That you have read the Google Translate notice, so it is shown once. | Until functional consent is withdrawn; otherwise until the tab closes |
| Your request | googtrans | This site · cookie | The language you chose, read by Google Translate. Set only when you choose a language other than English. | Until you switch back to English or close the browser |
| Your request | Google Translate cookies | Google · cookies | Set by Google's translation widget, which loads only after you agree to the translation notice. Governed by Google's privacy policy. | Set by Google |
| Your request | assistantConversation | This site · sessionStorage | The chat conversation, only if you choose “Keep for this tab”. Never sent to our servers. | Until the tab closes or you choose Clear |
| Administrators only | __Host-portfolio_session | This site · cookie (HttpOnly, Secure) | The signed-in administrator session for the admin portal. | 8 hours |
| Administrators only | __Host-portfolio_auth_state | This site · cookie (HttpOnly, Secure) | Protects the administrator sign-in exchange with the identity provider. | 15 minutes |
| Administrators only | admin_last_activity, admin_sidebar_collapsed, admin_blog_draft_v2_* | This site · localStorage | Idle sign-out across tabs, the portal layout, and unsaved editor drafts. | Drafts 24 hours; others until sign-out or cleared |
4. Privacy Architecture of First-Party Analytics
Our custom analytics pipeline is engineered ground-up with privacy-by-design:
| Field | Description | Retention |
|---|---|---|
| interaction event | One record per interaction: its kind, a short label, the page and content involved, the referring site's host (no path or query), the two-letter country code from our CDN, the time, and the same-day identifier below. For the chat, only that it was opened or that a question was asked, never its text. | 400 days |
| daily totals | Counts per day by kind of interaction, content, referring host, country and hour in UTC. They contain numbers, not individuals. | 400 days |
| same-day identifier | A one-way keyed hash of the network address and the date, with a secret that is rotated every week. It can tell that two events on the same day came from the same network, and cannot link days together. Nothing is stored in your browser. | 400 days |
| abuse identifier | A separate one-way hash held only to detect automated abuse, keyed on a secret rotated every week so it cannot link visits across weeks. Stored apart from the interaction record. | 400 days |
Analytics exclusions: readable network addresses, browser user agents, city, region, coordinates, and cross-site identifiers are not fields in the analytics record. Infrastructure security processing is separate. Daily totals expire after 400 days; lifetime content counters (for example, how many times a post was opened) have no automatic expiry. Physical TTL deletion is asynchronous and backups have separate retention. Withdrawing consent stops future optional collection; it does not delete prior records.
5. Your Choices & Preference Controls
- In-App Controls: You can adjust or withdraw consent for non-essential categories at any time using the Customize Cookie Settings button below or the persistent footer link.
- Immediate Revocation: Withdrawing consent immediately deletes stored preferences from your browser and disables optional telemetric transmission.
- Global Privacy Control (GPC): This website honors the Global Privacy Control browser signal. When your browser reports it (
navigator.globalPrivacyControl = true), optional analytics is switched off and nothing is sent, whatever was chosen before. - Browser Settings: You can configure your browser to block or delete cookies and local storage keys entirely. Note that blocking strictly necessary cookies will prevent form submissions and secure login from operating.
6. Chat Assistant and Translation
Chat assistant. The assistant answers from content published on this Site. Your browser downloads the published answers and matches your questions locally, so your questions are never sent to us or stored on our servers. Before your first question you choose whether the conversation is kept in this tab's session storage (it then survives a page reload and is deleted when the tab closes or you choose Clear) or not kept at all (it is then lost if you reload, open a link in a new tab, or close the tab). Links to pages on this Site open in place and keep the chat open either way.
Translation. Choosing a language other than English first shows a notice. Only if you agree is Google Translate loaded: the page text is then sent to Google to be translated and Google may set its own cookies, under Google's privacy policy. Machine translation may be inaccurate, and the English text, including this policy, is authoritative. Your browser's built-in translation is an alternative that does not use Google's widget on this Site.
7. Third-Party Services
The Site does not load third-party advertising, analytics, CAPTCHA, font, or social-tracking scripts. The one third-party script is Google Translate, loaded only when you ask for a translation and agree to the notice described in section 6. Links to external sites are governed by those sites' privacy policies.
Zero External Fonts & Third-Party CDNs
To eliminate third-party network metadata and IP address leakage, this site uses exclusively native operating system typography (system-ui, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif). Zero calls are made to Google Fonts, Adobe Typekit, or external font CDNs.
International Default Privacy Settings
In line with Quebec Law 25, India's DPDP Act 2023 and UAE Federal Decree-Law No. 45/2021, all optional analytics and preference storage default to off (opt-in only). Nothing optional is read or written before you choose; the chat and translation store something only when you ask for them.
8. Contact & Rights Inquiries
If you have questions regarding this Cookie Policy, your privacy preferences, or wish to exercise the data rights described in our Privacy Policy, please contact us directly:
Location & Operator: Hema Sai Mallampati · Dallas, TX, United States.
Acknowledgment & Resolution SLA: Inquiries and verified data requests will be acknowledged within 7 business days and fully resolved within 30 calendar days.
Note: This policy is strictly aligned to the cookies, browser storage, and consent behavior currently active on this website.
Maintained by Hema Sai Mallampati · Version 1.0 · Last updated: 2 October 2026 · Dallas, Texas, United States