Privacy Policy
What Code The Pixel collects, why, how long it is kept, and your rights under the PDPA.
Last updated
Last updated: 17 October 2026. This policy explains what personal data Code The Pixel (codethepixel.com) collects and what happens to it. It follows the Personal Data Protection Act 2010 of Malaysia (PDPA).
Who is responsible
The site is run by Asyraf Wahi Anuar, who is the data controller. You can reach me through the contact page.
What is collected
Reading the site
You can read everything without an account. The site does not use advertising or tracking cookies, and it does not build a profile of you. Article views and kudos are counted with a salted, one-way hash of your IP address and browser, which cannot be turned back into either. Your light or dark theme choice is stored in your own browser.
Comments
When you comment, I store your name, your email address and your comment. Your email is never shown. It is used to recognise returning commenters, to send you a reply notification if you ask for one, and to show your Gravatar picture. Showing it means your browser requests the picture from gravatar.com, which sees your IP address and a hash of your email. A salted hash of your IP address and browser is also stored to limit spam. Comments are reviewed before they appear and can be removed on request.
Contact form
When you write to me, I store your name, email, message and a salted hash of your IP address. I use them only to reply. You are asked to agree to this before sending. Messages and my replies are deleted automatically 12 months after they arrive.
Spam protection
Forms may use Cloudflare Turnstile to tell people from bots. Cloudflare receives technical details such as your IP address when the check runs, under its own privacy policy.
Videos and embeds
YouTube and CodePen embeds load only after you click them. Nothing from those services is loaded before that. YouTube videos use the privacy-enhanced youtube-nocookie.com domain.
Signing in
Only the site administrator signs in, with Google. Visitors do not need or get an account.
Cookies
Only technical cookies needed for forms and security are used. If I add analytics in future, this page will say so and a notice will ask for your consent where required.
Who sees your data
Your data is not sold or shared for marketing. It is stored on the web hosting provider that runs the site, and backed up. It is shared only with the services named above, and where the law requires it.
How long it is kept
Contact messages: deleted after 12 months.
Comments: kept while the article is online, or until you ask me to remove them.
View and kudos hashes: kept only as long as needed to avoid counting the same visit twice.
Your rights
Under the PDPA you can ask to see the personal data I hold about you, ask me to correct it, and withdraw your consent. To remove a comment or a message, contact me with the email address you used and the page it was sent from. I will respond within 21 days.
Changes
If this policy changes, the date above changes with it.