Privacy

This is a personal site. It shows no ads, builds no profiles and sells nothing about you. This page lists everything the site collects, why, and how to have it removed. Last updated November 2026.

In short

  • Reading the site sets no cookies and loads no trackers. Fonts, scripts and images are all served from this domain.
  • The server keeps a short technical log of each request to keep the site running and to spot attacks.
  • If you use the contact form, your name, email and message are stored so I can reply.
  • Google Analytics runs only if you click Accept on the analytics banner.

What my WAF sees

The panel on the home page shows your IP address, user agent, network, TLS details and some device facts. It reads them live from your own request and from your browser, shows them only to you, and does not store them. The device details (screen size, CPU cores, memory, time zone) never leave your browser.

Server logs

Like every web server, this one records each request: the time, your IP address, the page path, the response status, how long it took and the first 200 characters of your user agent. It never records cookies, form contents, search terms or other query strings. These logs are used only to keep the site working and to investigate abuse, and are deleted after a limited period.

Contact form

  • What is stored: the name, email address and message you send, and the time you sent it.
  • Your IP address is not stored. A salted one-way hash of it is kept so the form can limit how often one sender can post. The hash cannot be turned back into your IP address.
  • Email: your message is forwarded to my inbox through Amazon SES so I can reply to you.
  • Bot check: the form uses Cloudflare Turnstile, which checks your browser for signs of automation. Cloudflare processes that check under its own privacy policy.
  • Cookie: the contact page sets one security cookie, csrftoken, which stops other sites from submitting the form in your name. It holds no personal data.
  • Messages are kept until I delete them. Ask, and I will delete yours.

Analytics

When analytics is switched on, a banner asks first. Nothing from Google loads until you click Accept. If you accept, Google Analytics 4 measures which pages are read, under Google's privacy policy. Your choice is saved in your browser's local storage, not in a cookie, so the banner does not ask again. Clear your site data to change your mind.

Where the data lives

The site runs on Amazon Web Services in Sydney (ap-southeast-2), behind Cloudflare, which protects it from attacks and delivers it quickly. Every connection is encrypted with HTTPS, and the database is encrypted at rest. Only I can sign in to the admin side, with two-factor authentication.

Your choices

  • Read the site without accepting analytics. Nothing about you leaves your browser except the request itself.
  • Ask what I hold about you, or ask me to delete it, through the contact form. I will reply within 30 days.