Privacy
This site has no trackers or ads. It sees what any website sees when you visit, and what you send me through the contact form. Here’s all of it, and who handles it.
Updated
When you visit
Every page reaches you through Cloudflare, which sits in front of my server to block attacks. It sees what every browser sends with a request, such as your IP address and the page you asked for. My server keeps no log of visits. It logs only requests that go wrong, with the IP address that made them, and keeps that log for 52 days. I don’t use any of it to follow you around the site or build a profile of you.
If your browser blocks something on a page because it breaks the site’s security rules, such as a script from somewhere the site doesn’t use, it sends my server a short report. The server keeps what kind of report it is, the page, the rule, what was blocked and the date, leaving off anything after a “?” in an address. It doesn’t keep your IP address, your browser, cookies or anything you typed. When the file of reports reaches 256 KB, the server starts a new one and deletes the one before, so old reports don’t pile up.
The fonts and images come from this site itself, so opening a page sends nothing to Google or to any ad network.
The only page that sets a cookie is Start a project, which has the contact form. If Cloudflare ever stops a visit to check that you’re a person, it sets one of its own to remember that you passed.
When you write to me
The contact form sends me what you fill in: the options you pick, your name and email, your site and your message. The email I get also shows your IP address and the time between first opening the page and pressing Send. Both help me spot spam.
As soon as you start on the form, it loads Cloudflare Turnstile, a check that you’re a person. It looks at your browser and device, and usually asks nothing of you. When you press Send, my server asks Cloudflare whether the check passed, and includes your IP address. Cloudflare’s Turnstile privacy addendum says what it collects.
The page with the form sets one cookie, PHPSESSID. It’s a random ID that ties your visit to two things on my server: a code that stops other sites from sending the form in your name, and the time you first opened the page. It’s deleted when you close your browser. Other pages load the form ahead of time when you point at or tap a link to it, so it opens at once, and that can set the cookie before you get there.
To stop anyone flooding the form, the server counts how often each connection sends it in an hour. It keeps that count under a scrambled code made from your IP address, not the address itself.
The site keeps no copy of your message, with two exceptions. If sending fails, the server saves it so it isn’t lost. If my spam filter catches it, the server saves it so I can rescue a real one. Those copies stay until I delete them.
Who handles it
These are the companies that handle anything from this site. I read your message myself, and I don’t sell it or add you to a mailing list.
-
Cloudflare
Cloudflare’s privacy policy- What it does
- Carries every visit to my server and blocks attacks on the way. It also runs the form’s spam check and stores my server’s weekly backups.
- What it sees
- The details your browser sends with each request, what the spam check learns about your browser and device, and any message or browser report saved on the server, in the backups.
-
- What it does
- Owns the machine my server runs on. I set it up and look after it.
- What it sees
- The machine holds the server’s error log and the browser reports, and a message only when sending fails or my spam filter catches it.
-
Postmark
Postmark’s privacy policy- What it does
- Delivers the form’s email to me.
- What it sees
- Everything in that email. Postmark keeps a copy for 45 days, then deletes it.
-
Google
Google’s privacy policy- What it does
- Hosts my email.
- What it sees
- The same email, which stays in my inbox until I delete it.
No analytics company or ad network gets anything from this site.
Asking me to delete it
Write to me through the contact form, and I’ll tell you what I have from you, then delete it from my inbox and the server. The server’s backups roll over, so their last copy is gone within a month. Postmark’s copy expires on its own after 45 days.