Privacy

Visiting this website does not create a profile of you, does not set a cookie, and does not tell anyone else that you were here. There is no analytics package, no tag manager, no advertising pixel, no embedded video, no social widget and no comment system. The fonts are served from this site rather than from a font CDN, so loading a page does not disclose your IP address to a third party.

That is not a privacy stance so much as a consequence of how the site is built: it is a set of static files with no backend and nothing to log you into. There is no mechanism here that could collect anything, which is a stronger guarantee than a promise not to.

The site runs on Google Cloud Run behind NGINX, and like every web server it writes a line to a log each time a file is requested. That line contains your IP address, the date and time, the URL requested, the response status and size, and the browser's user-agent and referrer strings. It is written automatically as part of serving the page and is not linked to any identity, because the site holds no identities to link it to.

These logs exist for security and reliability — spotting an attack, diagnosing an error, confirming a deploy worked. They are never used to build a profile, are not combined with any other source, and are not shared with anyone. Under UK GDPR the lawful basis is legitimate interests: running a website securely is not possible without them, and the impact on you is minimal because nothing is done with the record beyond keeping the site up.

They are held in Google Cloud Logging on its default retention of 30 days, after which they are deleted automatically. We do not export them, copy them elsewhere or keep our own archive.

One item, and it never leaves your device. If you switch the site between its dark and light themes, that choice is saved in your browser's local storage under a single key so the site does not flash the wrong theme the next time you open it.

It is a preference, not an identifier: it holds the word for a theme and nothing else, it is not sent to the server, and it is not readable by any other site. Clearing your browser's site data removes it, and the site works normally without it — it simply follows your operating system's own dark/light setting instead.

The contact links on this site open your own email client; nothing is submitted through the website itself. If you write to us, we hold your email address and whatever you chose to put in the message, in our mailbox, for as long as we need it to deal with what you asked about and to keep a record of the conversation afterwards.

It is used to reply to you and for nothing else. We do not add correspondents to a mailing list, and there is no marketing to opt out of because there is none to begin with. The lawful basis is legitimate interests where you are asking us something, or the steps taken before a contract where you are asking us to quote for work.

The apps are separate products and this page does not describe them. Each one publishes its own policy covering what it collects, which services it talks to, and how to have your data deleted — those are linked further up this page, and they are the documents that count for the app in question.

The general position is the same in both, though. Neither app carries advertising, neither sells data, and neither shares anything with a data broker. Where an app sends something to a third party it is because a feature cannot work otherwise — an AI model that has to receive a clip in order to describe it, for example — and its own policy names the service, says exactly what reaches it, and says what is kept afterwards.

UK GDPR gives you the right to ask what personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form. There is no charge, and we will respond within one month.

In practice, for this website there is very little to exercise those rights against: correspondence in a mailbox, and server log lines that are not linked to you and expire on their own within 30 days. If you have used one of the apps, its own policy explains the deletion route built into it, which is usually faster than writing to us.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain directly to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk — you do not need our permission and you do not have to come to us first.

The website is served from Google Cloud Run in europe-west1, which is in the European Union, and its request logs stay in that region. The apps use services that are hosted elsewhere, including in the United States; each app's own policy says which, and where.

Where personal data does leave the UK, it is covered by the transfer terms in Google's data processing agreement, which incorporate the UK's International Data Transfer Addendum to the standard contractual clauses.

If this changes, the date at the top of the page changes with it, and the page itself is the current version — there is no separate mailing list and no notification to subscribe to.

Because the site is open about how it is built, a change to what it collects means a change to this text in the same release. If you want to know whether anything has changed since you last read it, the date at the top is the honest answer.