Privacy

There are no trackers, no advertising and no third-party scripts on this site. Nothing is loaded from a domain that is not this one — not fonts, not icons, not avatars. Page views on the public pages are counted, as described below; apart from that count, if you read the site and never write to me or enter an access code, nothing about you is stored anywhere except in your own browser.

The contact form is one of two places on this site that ask you for something and keep it; the other is the invite-only area’s access-code page, below. A message is stored so it can be read and replied to, and it keeps:

• Your nameSo a reply is addressed to a person.
• Your email addressSo there is somewhere to reply to.
• Subject and messageThe enquiry itself.
• Which project or topic you wrote aboutSo the reply has the right context.
• The IP address the message came fromTo investigate abuse of the form. It is not used for anything else, and never for analytics.
• Your browser's user-agent stringStored with the message for the same reason as the IP — telling an abusive script from a person. Never used to profile you, and never for analytics.

Messages are kept until they are deleted by hand, because a reply thread is worth having later. There is no automatic deletion. If you would like a message of yours removed, ask and it will be — see below.

While the site’s email is set up, each message is also emailed to the owner as it arrives, so a copy of it is in the owner’s own mailbox too — see “What sees your data”.

Entering a valid access code stores a signed session cookie so you do not have to enter it again. The code you used is recorded against that session so it can be revoked. Each time a code is accepted, whether or not you give a purpose, the code’s record in the site’s store counts one more use and notes that moment as its last change. Entering the code again while you are still signed in with it records nothing new.

The code page also has an optional purpose field. If you fill it in and your code is accepted, what you wrote is kept, with the time you unlocked, in an access log held against your code in the site’s store. It stays there until the owner deletes the code — disabling it is not enough — though the log keeps only a code’s most recent entries, so an older note can be dropped sooner to make room.

Every attempt at a code is counted against your IP address, a correct code as well as a wrong one, to make guessing a six-digit code impractical; the one exception is an attempt that could not be checked because the site’s store did not answer, which is not held against you. Each count expires on its own 15 minutes after the first attempt in it.

Visits to the public pages are counted with Vercel Web Analytics, run by Vercel, which already hosts this site. Its script is served from this site’s own domain and runs only on the live site.

What it is sent is limited here, before anything leaves your browser: the path of the page you viewed, and nothing else from the address — never the query string, so nothing you type into a search is part of it. The admin office and the invite-only area, including its code-entry pages, are never counted at all. This site sets no cookie for it; Vercel describes Web Analytics as working without cookies, and its Web Analytics documentation says what Vercel derives from a visit and how long it is kept.

These services, and only these:

• VercelHosts the site and serves every page. Sees the requests a web server sees.
• Upstash / Vercel KVStores contact messages, access codes and the purpose notes logged against them, and rate-limit counters.
• Vercel Web AnalyticsCounts page views on the public pages, from this site's own domain. Is sent the page's path and nothing else from the address — never the query string — and nothing at all from the admin office or the invite-only area.
• PostmarkOnly while the site's email is configured: carries a notification of every enquiry — your name, email address, which project or topic you wrote about, subject and message — to the owner's own mailbox as it arrives, and carries the owner's replies to you.
• The owner's own mailboxReceives that notification of each enquiry, so it holds a copy of your message as any mailbox holds the mail it is sent. It is with whichever email provider the owner uses.

Project details — stars, languages, dates — are fetched from GitHub by the server, not by your browser, so GitHub never sees that you visited. Every page renders completely if that request fails.

A theme preference, an accent preference, a note that you dismissed the install offer, a copy of this site’s files and of the pages you have visited so they open offline, and — only if you signed in — a session cookie. Nothing from the invite-only area is kept offline. The cookie page lists all of them, what sets them and how long they last.

You can ask what is held about you, ask for it to be corrected, ask for it to be deleted, or object to it being held at all. There is no form for this and no account to log into: send a message from the contact page and it will be handled within 30 days, usually the same week.

The controller is Robin G. Thapa, an individual, reachable through that form.

If this notice changes, the date at the top changes with it. The site’s source is public, so the change itself is visible in its history rather than only summarised here.