What's collected
This site has three forms. Each one only collects what it says it does:
- "What's not working?" (the pain-share widget): a message, optional tags describing what kind of thing it is, and an email address only if you tick "I'd like a reply."
- "Request relevant details" (on each case study): an email address and a short note on what you're exploring. Used only to reply to you, never for a mailing list.
- Article feedback: a clarity rating, an optional comment, and an optional name and email. Whether you're comfortable being quoted anonymously is your choice, via a checkbox, and nothing is published unless you tick it.
None of these fields are required beyond what's marked required on the form itself, and none of it is used for anything other than the stated purpose.
Newsletter
The "Subscribe" form on the homepage, at the end of articles, and on the newsletter page collects one thing: your email address, so I can send new writing to it. Nothing else is asked for.
To be direct about where this stands today: no newsletter has gone out yet, and this form doesn't send a confirmation email either, since sending one honestly requires the same sending setup as the newsletter itself, and I'd rather build that properly, in one pass, than fake a confirmation step that leads nowhere. When sending does start, every email will carry a one-click unsubscribe link, and I'll update this page to say so plainly. Until then, if you'd like to be removed at any point, email me and it's done immediately.
This list is never shared, sold, or used for anything other than sending the newsletter you signed up for.
Site traffic
To see which pages get read and where visitors come from, so I can improve the content and fix what isn't working, this site measures traffic in two ways, both first-party and both designed so no individual visitor can be identified or followed between visits.
The first is Netlify Analytics, built from the hosting server's own request logs. Nothing runs in your browser for it, nothing is stored on your device, and what it shows is aggregate: page views, referring sites, and response codes.
The second is a small first-party analytics script on the site's own pages. It measures things the server logs can't see on their own: which articles actually get read and how far, roughly how long a page holds attention, which links and buttons get used, page-loading performance, and JavaScript errors, so I can find and fix what's slow or broken. It is built to be as unintrusive as this kind of measurement can be:
- No cookies, and nothing kept on your device between visits. The only thing it stores is a random, temporary marker held in
sessionStoragethat lets one visit's page views be counted together; your browser erases it the moment you close the tab. There is no persistent identifier, so there is no way to recognise you on a later visit. - Your IP address is never stored. It is used for a moment on the server only to work out an approximate country and region, then discarded before anything is saved. No table or log here holds an IP.
- No fingerprinting. No canvas, WebGL, audio, or font probing; no exact screen size, and nothing that tries to build a hidden signature of your device.
- Nothing you type is captured. The script notes only that a form was started, completed, or hit a validation error, never the contents of any field.
- Your choice is respected automatically. If your browser has Do Not Track or Global Privacy Control switched on, the script does not run at all. No banner to click, no setting to find.
What's not collected
No advertising trackers, no cross-site tracking, and no cookies of any kind. The only things ever kept in your browser are a light or dark theme preference in localStorage and, while a tab is open, the temporary analytics marker described above in sessionStorage. Neither leaves your browser as an identifier, and neither is used to work out who you are.
Where it goes
Form submissions, the newsletter list, and the first-party analytics described above are all handled the same way: submitted through Netlify, the company that hosts this site, and stored in this site's own database (hosted on Supabase), used only by me, to understand and improve the site or to send the newsletter you asked for. Neither Netlify nor this site sells any of this data or shares it with anyone else. You can read Netlify's privacy policy and Supabase's privacy policy for how each handles data on their end.
How long it's kept, and how to have it deleted
Form submissions are kept only as long as they're useful, read personally, and not shared or published unless you've explicitly agreed to that (the feedback form's quote checkbox is the only case where this applies). A newsletter subscription is kept until you unsubscribe or ask to be removed; there's no other expiry, since it's just a list of who to email. Analytics is kept on a fixed schedule: individual page-view and event records are deleted after about 13 months, error and security records after about 90 days, and only day-by-day totals, which describe no individual, are kept longer for year-on-year comparison. If you'd like something you submitted deleted, email me with roughly what you sent and when, and it'll be removed.
Changes to this page
If what this site collects or how it's handled ever changes, this page will be updated to match, and the date at the top will reflect that.