privacy.md
Privacy
last updated 2026-09-21
No cookies. No trackers. No ads. No third-party scripts. The only personal data this site can hold is your email address — if you asked for the newsletter. That is the entire list, and the rest of this page is the proof.
Newsletter — the only data we keep
If you subscribe, we store your email address in a SQLite file on our own server, on our own hardware. The schema is your address, a subscription status, and three timestamps. Nothing else. Double opt-in: you confirm before anything is ever sent. We never share, sell, rent, or trade it — there is no third party to share it with.
Every mail carries a one-click unsubscribe link (RFC 8058) that works forever. Or write to [email protected] and it is deleted — gone means gone, no "retention period", no backup that outlives you.
Analytics — self-hosted, cookieless
We count page views with Rybbit, running on our own hardware and served from this
domain (/analytics/). It sets no cookies, does no fingerprinting, and
tracks nothing across sites. We see anonymous page views and referrers — not people.
We could not build a profile of you if we wanted to.
Rate limiting — in memory only
Public forms are rate-limited by IP address to stop abuse. Those records live in RAM for minutes and evaporate on their own or on the next restart. IPs are never written to disk, never attached to your email, never used for anything but "this socket is hammering the form".
What loads in your browser
One script: our own analytics proxy at /analytics/. Fonts are
self-hosted. There is no Google Analytics, no ad network, no social pixel, no CDN
fingerprinting surface, no A/B testing. The page you read is served from the same
domain you see in the address bar.
Infrastructure
This site runs on a home server behind Cloudflare, which necessarily sees connection metadata to route your requests, and keeps routine, short-lived logs for security — as any host on the internet does. When we send newsletter mail, your address passes through our SMTP relay for delivery. Nobody else is in the chain.
Your rights
UK GDPR applies and we treat it as a floor, not a ceiling: access, correction, erasure — email [email protected] and it is done by hand, promptly. There is no account system to fight with and no data broker web to untangle. Deleting your address from one SQLite file is the whole operation.
Changes
If this page ever changes in a way that matters, the date above moves and the newsletter mentions it. We have no incentive to be sneaky: the entire business model of this site is that it collects almost nothing.