A plain note about Privacy.

Nothing is ever typed into this site, because there is nowhere to type it. All of this is picked up automatically as the page loads.

On every visit, whatever you choose:

• Your IP address, browser, version and operating system — any web request reveals these.
• The address of the page you asked for, and the language your browser says it prefers.
• Approximate location — country, region, usually city — worked out from that IP address. Never GPS; the page never asks.

That much is unavoidable, and it is not analytics. Cloudflare has to receive it to serve you the page at all, and Google receives it too when the typefaces load, because a font request carries your address and browser and the page asking for it. Self-hosting the two typefaces would cut Google out of that entirely, and it is on my list.

Only if you accept:

• A random, pseudonymous ID for your browser, plus screen size, viewport and colour depth.
• The page title, and the site or search engine you came from.
• Page views, plus the scroll depth and the clicks out to LinkedIn, Discord, Ko-fi or the project links that Google Analytics measures by default.

That second list is Google Analytics, and none of it happens unless you accept. Until then its tag is not even fetched, so Google Analytics is never told you are here.

Why: to see whether anyone reads this, and which project they click. That is the whole reason.

Two cookies, both written by Google Analytics onto my own domain rather than a third-party one, and both only after you accept.

“As configured” is doing real work. Because both are written by JavaScript, Safari caps them at seven days and Firefox and Brave apply their own limits, so the true lifetime is often far shorter.

One more thing lives in your browser, and it is not a cookie. When you answer the note at the foot of the page, your answer is saved to this site’s local storage under pv-consent, with the date of this policy and the moment you chose. It is never sent anywhere, it is not readable by any other site, and it exists only so I do not have to ask you again. It lapses after a year. Clearing your site data removes it, and so does the button under “Turning it off” below.

Google Fonts sets no cookies at all. Cloudflare’s security layer may set a short-lived one of its own to tell bots from people; that one is strictly necessary, never analytics, and it is set by a response header rather than by anything on this page.

• Cloudflare hosts the site, so it sees every request: IP, timestamp, path, status, browser.
• Google Fonts (fonts.googleapis.com and fonts.gstatic.com) gets your IP address, your browser string, your language preference and the address of the page you are on, every time the typefaces load. It sets no cookies — the files are fetched in a mode that sends none.
• Google Analytics is loaded from googletagmanager.com only once you have accepted, and then gets the second list above. Decline, or leave the note unanswered, and the tag is never fetched, so googletagmanager.com is never contacted at all.
• Google as my mail provider — if you email me, it lands in a Gmail inbox. Nothing is submitted through the site; those links just open your own mail app.

LinkedIn, Discord, Ko-fi and the project sites get nothing unless you click. If you do, they see your IP address, your browser, and that you came from here.

The site is static: no server-side code, no database, no admin login and nothing of yours stored on it. It is served over HTTPS, with the encryption terminated by Cloudflare at its edge — which is why Cloudflare can see the traffic in the clear and I cannot.

Cloudflare, Inc. and Google LLC are United States companies running global networks. Cloudflare answers from whichever of its locations is nearest you, which may well be outside your own country, and Analytics data is processed in the United States among other places. Both move personal data under their own standard contractual clauses and, where it applies, the EU–US Data Privacy Framework.

Analytics does not load at all until you ask for it. The tag file is fetched only when you press Accept in the note at the foot of the page. Decline, or close the note without answering, and nothing is requested from Google Analytics and nothing is sent to it: no page view, no identifier, no cookie. (The typefaces are a separate matter, and they load either way — that is the first list above.) Your answer is remembered in this browser only, never on a server, and you can change it whenever you like.

Being straight about the history: until 28 July 2026 the tag ran without asking anyone. If you visited before that, your browser may still be carrying an old _ga cookie — the site now deletes any it finds, on every visit where analytics has not been accepted.

The legal bases, named:

• Hosting and its request logs — legitimate interests, Art. 6(1)(f). The site has to be served and kept standing.
• Google Fonts — legitimate interests too, and the thinnest of these: as said above, self-hosting the two typefaces would remove the disclosure to Google altogether.
• Analytics and its two cookies — your consent, Art. 6(1)(a). ePrivacy and the UK’s PECR require it for cookies that are not strictly necessary, and these are not.
• Email — because you wrote to me, and answering is the point.

Withdrawing has to be as easy as agreeing was, so here is the same control, in the same place in the page as the original question. It forgets your recorded answer, switches Analytics off immediately, clears the cookies, and asks again.

Beyond that: block cookies for this site in your browser settings, or install Google’s official Analytics opt-out add-on (opens in a new tab). Any content blocker that stops googletagmanager.com works too. Nothing breaks either way — no feature hides behind the tracking.

The two cookies expire as above. The Analytics data behind them sits with Google and is deleted at the end of the retention window set on the property — Google Analytics offers a choice of two months or fourteen, and nothing is kept past whichever one is set. Cloudflare keeps its request logs briefly, under its own published schedule (opens in a new tab). Your answer to the cookie note lapses after a year, and you are asked again. Emails stay in my inbox while the conversation is live and for up to two years after; ask, and I will delete yours sooner.

Under the GDPR and UK GDPR you can ask for access, correction, erasure, restriction or portability, withdraw your consent at any time, and object to the analytics outright. Under Singapore’s PDPA you can ask what I hold and have it corrected. You can also complain to your local data protection authority.

One honest caveat: the analytics data is pseudonymous and I only ever see aggregate charts, so I cannot reliably match a row to a person — unless you send me the value of your _ga cookie, which I can pass to Google to have the records tied to it deleted. Failing that, the fastest way out is the button above, or clearing cookies.

This site is not aimed at children and I knowingly collect nothing from them; if a child has emailed me, tell me and I will delete it. If any of this changes, I will rewrite the page, move the date at the top, and the cookie note will ask everyone again.