Privacy

Pages on this site are measured by Vercel Analytics and Vercel Speed Insights. Between them they record page views, the site that linked you here, an approximate country, your device and browser type, and how quickly pages loaded. Both are cookieless, and what I see is aggregate numbers rather than individual people.

I also keep my own count of which posts get read. For each view that means the post, the time, the country the request came from, the browser’s user-agent string, and the origin of whatever linked you — the domain on its own, never the full address of the page you came from.

What is not stored is anything that identifies you. Rather than recording your IP address, each view carries a one-way fingerprint: your IP address and user-agent string are combined with a secret value and the current UTC date, and that combination is run through SHA-256. What reaches the database is the resulting 64-character digest, and nothing else.

Two properties of that are worth spelling out. It is one-way — there is no calculation that turns the digest back into an IP address. And because the date is part of what gets hashed, the digest changes at midnight UTC every day. The practical effect is that I can see one person read four posts in an afternoon, which tells me something useful about what’s worth writing more of. I cannot tell that the same person came back a week later — and neither could anyone who somehow got hold of the database.

The user-agent string is kept as sent, because it is how automated crawlers get told apart from people actually reading.

If you send me a message, I receive your name, email address and the message itself. It is delivered to my inbox and kept so that I have a record of the conversation. It is used to reply to you and for nothing else: no mailing list, no sharing, no selling.

There are no advertising or tracking cookies here. If you unlock a password-protected post, one cookie remembers that so you are not retyping the password on every page; it expires on its own after a few hours. Your light or dark theme choice is saved in your browser’s local storage and is never sent to me.

The site runs on Vercel (hosting and analytics), stores data with Supabase, sends email through Resend, and serves photographs and video from Cloudflare. Each has its own privacy policy, linked above. Your request necessarily passes through these services, and some of them operate outside Canada.

Reading stats are kept indefinitely. Once the day rolls over they can no longer be connected to a person, so there is little reason to discard them. Contact messages are kept until you ask me to delete them. Server logs are held briefly by Vercel and then discarded automatically.

Ask and I will delete your contact message, or tell you what I hold about you. For reading stats there is genuinely nothing to hand over or delete on request — I have no way to work out which rows are yours, which is rather the point of the design above.

Every browser lets you block cookies. Blocking mine costs you nothing except retyping post passwords.

If what I collect changes, this page changes with it and the date below moves.