Privacy

There are no analytics, no trackers, no advertising, no fingerprinting and no third-party scripts on this site. Nothing is loaded from a domain that is not this one — not fonts, not icons, not avatars. If you read the site and never write to me, nothing about you is stored anywhere except in your own browser.

The contact form is the only place this site takes anything from you. A message is stored so it can be read and replied to, and it keeps:

• Your nameSo a reply is addressed to a person.
• Your email addressSo there is somewhere to reply to.
• Subject and messageThe enquiry itself.
• Which project you wrote fromSo the reply has the right context.
• The IP address the message came fromTo investigate abuse of the form. It is not used for anything else, and never for analytics.
• Your browser's user-agent stringStored with the message for the same reason as the IP — telling an abusive script from a person. Never used to profile you, and never for analytics.

Messages are kept until they are deleted by hand, because a reply thread is worth having later. There is no automatic deletion. If you would like a message of yours removed, ask and it will be — see below.

Entering a valid access code stores a signed session cookie so you do not have to enter it again. The code you used is recorded against that session so it can be revoked. Failed attempts are counted per IP address for fifteen minutes, to make guessing a six-digit code impractical; those counters expire on their own.

Three services, and only these:

• VercelHosts the site and serves every page. Sees the requests a web server sees.
• Upstash / Vercel KVStores contact messages, access codes and rate-limit counters.
• PostmarkSends the reply when the owner answers a message. Only sees messages that are replied to.

Project details — stars, languages, dates — are fetched from GitHub by the server, not by your browser, so GitHub never sees that you visited. Every page renders completely if that request fails.

A theme preference, an accent preference, a note that you dismissed the install offer, a copy of this site’s files and of the pages you have visited so they open offline, and — only if you signed in — a session cookie. Nothing from the invite-only area is kept offline. The cookie page lists all of them, what sets them and how long they last.

You can ask what is held about you, ask for it to be corrected, ask for it to be deleted, or object to it being held at all. There is no form for this and no account to log into: send a message from the contact page and it will be handled within 30 days, usually the same week.

The controller is Robin G. Thapa, an individual, reachable through that form.

If this notice changes, the date at the top changes with it. The site’s source is public, so the change itself is visible in its history rather than only summarised here.