Sushinet — Website & Studio Privacy Policy
Last updated: 17 August 2026.
This policy covers this website (www.sushinet.fyi) and our general dealings as a studio —
email, enquiries about custom work, and the Sushinet company page on LinkedIn.
It does not cover what happens inside our Shopify apps. When a merchant installs one of our apps, we process their store's data on their instructions, under a separate policy and a separate contract. Those live here:
Summary — the short version
- There is no sign-up, no login and no form on this website. Nothing on it asks you for your
name, your email or your store. That is deliberate, and it is enforced at the browser level: the
site's Content-Security-Policy sets
form-action 'none', so this site cannot submit a form even if one were added by mistake. - This site sets no cookie of its own. The only cookies possible here are Google Analytics',
described in Cookies. (Two cookies do exist on the separate
api.sushinet.fyisubdomain, but only we can ever receive them — they are part of us signing in to administer our own LinkedIn page, and no visitor to this site is issued one. See LinkedIn.) - We measure traffic with Google Analytics and with Vercel's first-party analytics. Google Analytics is the only thing here that can set a cookie, and it is switched off by default for visitors in the EEA, the UK and Switzerland — see Cookies.
- We do not advertise, retarget, profile, or sell or share anyone's data. There is no ad pixel on this site and no advertising identifier.
- If you email us, we have your email. That is the only way this site can learn who you are.
- Questions, or any request about your data: support@sushinet.fyi. A person reads it.
Who we are
Sushinet is the trading name of Edwin Guo (ABN 20 938 499 163), a sole trader in New South Wales, Australia. For the purposes of the GDPR, the UK GDPR and the Australian Privacy Act 1988, that individual is the data controller for everything described in this policy.
We name a person rather than only a trading name because a trading name is not a legal person, and a privacy policy has to say who is actually accountable. It is also the only place on this site where a name appears.
Contact: support@sushinet.fyi
1. What this website collects
1.1 Analytics — Google Analytics 4
We run Google Analytics 4 (property G-YMJP0M2KGN) to see which pages get read and where readers
come from. It records, per visit:
- the pages viewed, and when
- the referring site or search engine, if any
- an approximate location (country/region), derived by Google from your IP address
- device type, screen size, browser, operating system and language
Google acts as our processor for this, under
Google's Measurement Controller-Controller Data Protection Terms.
IP addresses are not stored by GA4; Google uses them to derive coarse location and then discards
them. We have not enabled Google Signals, advertising features, remarketing or data sharing for
advertising purposes, and the tag sends npa=1 (non-personalised) on every hit.
In the EEA, the UK and Switzerland, Google Analytics is denied storage consent before it loads. It runs in cookieless mode there: no cookie is written, and Google receives an aggregate, non-identifying ping instead of a per-visitor record. See Cookies for exactly what that means and which countries it covers.
1.2 Analytics — Vercel Web Analytics and Speed Insights
Our host, Vercel, provides two first-party measurement scripts. They count page views and measure real-world loading speed (the Core Web Vitals). They are cookieless, they use no persistent identifier, and Vercel states that they collect no personal data. We use them because page speed is something we make claims about, and a claim we do not measure is a guess.
1.3 Server logs
Vercel, as our hosting provider, logs requests to this site: IP address, timestamp, the URL requested, response status and user-agent string. These are ordinary web-server logs, kept briefly for delivery, debugging and abuse prevention. We do not mine them, join them to anything else, or use them to build a profile.
1.4 What this website does not collect
- No accounts, passwords or logins — there is nothing to sign in to.
- No contact form, newsletter form, or any other form.
- No advertising or social-media tracking pixels of any kind.
- No session recording, heatmaps, mouse tracking or scroll-tracking beyond the aggregate analytics above.
- No fingerprinting, and no attempt to identify you across other websites.
2. If you email us
The email address on this site goes to a mailbox we read. If you write to us we hold your email address, your message, and anything you choose to put in it, so that we can reply and keep a record of what was agreed.
We keep enquiry email for as long as the conversation is live, and for up to two years afterwards so that we can answer a follow-up about work we did. Email relating to paid work is kept for seven years, because Australian tax law requires us to keep business records that long. Ask us to delete your email at any time and we will, unless that record-keeping obligation applies — in which case we will tell you so, and say when it expires.
3. LinkedIn
We run a Sushinet company page on LinkedIn.
- If you follow, react to or comment on that page, LinkedIn processes that under its own privacy policy. We do not control what LinkedIn collects, and for the page's audience statistics we and LinkedIn are joint controllers, on the terms LinkedIn publishes for Page Insights.
- What we see is aggregate: follower counts, and demographic summaries of the audience that LinkedIn produces. We cannot see, and do not receive, the individual browsing history of anyone who visits the page.
- If you send us a LinkedIn message, we hold it the same way we hold email (§2).
Programmatic access. We use LinkedIn's APIs only to administer and measure our own company page — to publish a post to it, read its posts back, and read its own statistics.
To do that, a Sushinet administrator signs in to LinkedIn through LinkedIn's own consent screen. The permissions we request are limited to that purpose:
| Permission | What it lets us do |
|---|---|
| Read the signing-in administrator's basic profile | Confirm who is authorising, and that they may act for the page |
| Write organisation content | Publish a post to the Sushinet page |
| Read organisation content | Read the Sushinet page's own posts and their statistics |
We request no permission to read any other LinkedIn member's data, and we do not use LinkedIn's APIs to look up, enrich or contact anyone.
The sign-in happens on a separate subdomain, api.sushinet.fyi, and it sets two cookies on that
subdomain only: a short-lived random value that protects the sign-in against cross-site request
forgery, and the resulting access token. Both are HttpOnly and Secure, so no script can read
them; neither is set on this website, and no visitor is ever issued either one — they exist only
for the administrator doing the authorising, which is us.
Data obtained through those APIs is used solely to run the page. It is not combined with data from this website or from our apps, not sold or shared, not used for advertising or profiling, and is deleted when it is no longer needed or on request. We comply with LinkedIn's API Terms of Use.
4. Cookies
This site sets no cookies of its own. It has no session, no preference store and no consent
state to remember. (The two cookies on the api.sushinet.fyi subdomain belong to our own LinkedIn
sign-in and are never issued to a visitor — see LinkedIn.)
The only cookies that can be set here are Google Analytics':
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
_ga |
Google Analytics | Distinguishes one browser from another so a returning visit is not double-counted | 2 years |
_ga_G-YMJP0M2KGN |
Google Analytics | Keeps analytics session state | 2 years |
These are not set for visitors in the EEA, the UK or Switzerland. We use Google Consent Mode v2
with analytics_storage denied by default for those regions, declared before the tag loads, so
there is no window in which a cookie is written and then withdrawn. In those regions GA4 falls back
to cookieless pings. The regions are: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark,
Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg,
Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Iceland,
Liechtenstein, Norway, the United Kingdom and Switzerland.
Elsewhere, the two cookies above are set. If you would rather they were not, any browser will block them, and Google's own opt-out add-on blocks Google Analytics across every site at once. Nothing on this site breaks if you do — there is no functionality behind the analytics.
Advertising, ad personalisation and ad user data are denied everywhere, for everyone, without exception.
5. Why we are allowed to process it
For visitors in the EEA and the UK:
- Analytics outside the EEA/UK/CH, and server logs: our legitimate interests (Art. 6(1)(f)) in understanding whether our writing is read and in keeping the site available and secure. We have weighed that against your interests: the data is coarse, it is not used to make any decision about you, it is not combined with anything else, and it is not used for advertising.
- Analytics inside the EEA/UK/CH: no cookie or similar storage is used, so no consent is required for it.
- Email you send us: performing or preparing a contract (Art. 6(1)(b)) where you are asking about work, and legitimate interests in answering correspondence otherwise.
- Records of paid work: a legal obligation (Art. 6(1)(c)) — Australian tax record-keeping.
We do not process special-category data, and nothing on this site involves automated decision-making or profiling.
For visitors in Australia, we handle personal information in accordance with the Australian Privacy Principles.
6. Who else sees it
We keep the list of companies involved in this website deliberately short:
| Who | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting, CDN, first-party analytics, server logs | United States, with a global edge network |
| Google LLC | Google Analytics 4 | United States and Google's global infrastructure |
| LinkedIn (Microsoft) | Our company page, if you interact with it | United States and Microsoft's global infrastructure |
| Porkbun LLC | Domain registration and DNS for sushinet.fyi |
United States |
That is the entire list for this website. We do not sell, rent or share personal data with anyone else, and we have never done so.
7. Sending data overseas
We are in Australia; Vercel, Google and LinkedIn are in the United States. So data described here does leave the EEA, the UK and Australia.
For EEA and UK visitors, those transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in each provider's data-processing terms, together with the EU–US and UK–US Data Privacy Framework, in which Google and Microsoft both participate. For Australian visitors, we take reasonable steps under APP 8 before disclosing information overseas.
8. How long we keep things
| What | How long |
|---|---|
| Google Analytics event data | 14 months, then deleted by Google automatically |
| Vercel Web Analytics / Speed Insights | Aggregate only; retained per Vercel's retention for our plan |
| Server logs | Short-term, per Vercel's platform retention |
| Enquiry email | Life of the conversation, then up to 2 years |
| Email and records relating to paid work | 7 years (Australian tax law) |
9. How we protect it
This website is a set of static files. There is no database behind it, no user-uploaded content and no visitor login — so there is very little to attack and nothing about you stored on it.
The one exception is the LinkedIn sign-in described in §3, which runs as two small functions on the
separate api.sushinet.fyi subdomain. They are reachable by anyone, but they can only ever start
LinkedIn's own consent screen and hand the result back to whoever completed it; they read nothing
from this website, hold no database, and store nothing about visitors.
On top of that, every response carries: HTTPS with HSTS preloading; a Content-Security-Policy that
allows scripts only from this origin and Google's tag, blocks form submission entirely
(form-action 'none'), blocks framing entirely (frame-ancestors 'none') and blocks plugins
(object-src 'none'); X-Content-Type-Options: nosniff; a strict Referrer-Policy; and a
Permissions-Policy that switches off camera, microphone, geolocation and interest-cohort tracking.
10. Your rights
Wherever you are, you can ask us to tell you what we hold, give you a copy, correct it, or delete it, and we will do so free of charge.
If you are in the EEA or the UK, you also have the right to restrict or object to processing, the right to data portability, and the right to object to processing based on legitimate interests — including our analytics — at any time. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising.
Email support@sushinet.fyi. We aim to reply within a few days and will always respond within 30 days. We will not charge you, and we will not make you create an account to ask.
If you are unhappy with our answer, you can complain to a regulator: in Australia, the Office of the Australian Information Commissioner; in the EEA, your national supervisory authority; in the UK, the Information Commissioner's Office. We would rather you told us first, and we will try to fix it.
11. Children
This site is aimed at people who run or build online shops. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, email us and we will delete it.
12. Changes to this policy
When this policy changes we update the date at the top and publish the new version here. The policy lives in the same source repository as the website and is deployed with it, so the published version is always the current one — it cannot drift from what the site actually does by sitting in a document somebody forgot to redeploy.
If a change materially affects what we collect or why, we will say so plainly at the top of this page rather than quietly editing a clause.
13. Contact
support@sushinet.fyi — support, privacy requests, complaints, and anything else.
Sushinet is the trading name of Edwin Guo (ABN 20 938 499 163), New South Wales, Australia.