Last updated: 2026-09-24

Privacy

This is the personal website of Vũ Nhật Khánh. I built it and I run it. It does not sell data, does not carry advertising, and does not use third-party tracking.

If you are just reading the site

There are no tracking cookies and no third-party analytics. The hosting provider (Cloudflare) keeps ordinary technical logs such as IP addresses and browser type in order to serve and protect the site. I do not use those logs to identify you.

The calendar tool

This site hosts a tool that lets me share my availability and accept bookings. It connects to my own Google account only. You never sign in to Google to use it.

My Google data

• The tool reads busy/free times from calendars I select, and creates, moves or cancels events for bookings made through this site.
• My Google refresh token is encrypted with AES-GCM before it is stored, and can only be decrypted server-side.
• The tool requests four minimum permissions: list my calendars, read busy/free times, manage events, and basic identity so I can sign in to the admin screen. It does not request full calendar access.
• Use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

If you view a shared calendar link

Each link has its own passcode and its own settings. A link set to "busy blocks only" will never show event titles, locations or guests — that information is not sent to your browser in any form, including the page source.

To stop passcode guessing, I store a hash of your IP address alongside a count of failed attempts. The hash is salted with a server secret, so it cannot be reversed back to your IP address, and the record is deleted once the lockout window passes.

If you book a time

I store what you type into the form:

• your name and email address (needed to send the calendar invitation)
• your phone number, if you book a phone call
• any note you add
• your timezone and language, so times display correctly

This is used to create the event on my calendar and add you as a guest. Google sends the invitation email — that email comes from Google, not from this site. I do not send marketing email and I do not share your details with anyone.

Keeping and deleting data

• Bookings are kept for 12 months after the meeting date, then deleted.
• Passcode attempt records are deleted once the lockout window passes.
• You can cancel a booking at any time using the link in your calendar invitation.
• To have your data removed sooner, message me — contact details are on the profile page.

Changes

If this page changes, the date at the top changes with it. The full history is public in this site's source repository.