PLAIN ENGLISH

Privacy.

Requests and messages

When you request access or contact me, your name, email, and message are stored in a private admin inbox. You must confirm access to your email using a single-use link before review. Confirmation is not identity verification; an invitation does not prove a person’s legal identity.

Submissions also record the time, IP address and approximate location when supplied by the hosting provider, hosting request ID, browser and device information, language, and referring domain. These details are visible only to the admin for review and spam investigation. Browser details can be spoofed, and location may reflect a VPN or proxy rather than the sender. We do not collect precise GPS location.

Approved visits

When you use an approved invitation, the site records pages visited, timestamps, page-visit frequency, and your IP address when available from the hosting provider. These records are connected to the name and email on your request and are visible only to the admin. Anyone using your invitation will appear under your request.

An essential, HttpOnly cookie keeps your access active in this browser. The invitation works once and expires one hour after it is generated. The admin can revoke it sooner. These access records are separate from optional analytics; do not request access if you do not want this activity associated with your request.

Retention and deletion

Access requests, contact messages, invitations, and associated activity are deleted after 90 days by daily cleanup. You can ask the admin to delete them sooner using the contact form. Hosting and database backups may have separate retention periods.

Service providers

Vercel hosts the site and Supabase stores requests, access records, and content. Supabase also authenticates the admin. Cloudflare Turnstile checks submissions for bots, and Resend delivers confirmation emails. Blocked email hashes are retained until the admin removes the block. No fingerprinting, session replay, or identity enrichment is used.