Privacy policy
Last updated: September 19, 2026
This site runs no advertising and no cross-site tracking. It uses Cloudflare Web Analytics, a cookieless, privacy-focused analytics tool, and the only personal data it otherwise handles is what you choose to submit through the contact form.
What I collect
If you use the contact form: your name, email address, and message. Beyond that, Cloudflare Web Analytics counts page views in aggregate without cookies or persistent identifiers, and Cloudflare's bot protection may briefly set a security cookie (see below).
Why I collect it
Solely to reply to your message. The legal basis is legitimate interest in responding to enquiries sent to me directly.
How your message is protected
The contact form encrypts your name, email, and message in your browser using PGP, to a public key published on this site, before anything is sent. The server that receives the submission — and my email provider — only ever see the encrypted ciphertext; only I can decrypt it, with the matching private key. The connection itself is also protected by HTTPS. As with any in-browser encryption, this depends on the security of your own device and browser.
Spam and abuse protection
The form uses Cloudflare Turnstile, a bot check that does not build an advertising profile of you. Submitting the form also briefly uses your IP address to verify you're not a bot and to limit how many messages can be sent in a short period — this is discarded automatically within about an hour and is never stored alongside your message or used for any other purpose.
Analytics and security cookie
Cloudflare Web Analytics measures page views in aggregate. It doesn't use cookies or track you across sites, and doesn't build a profile of individual visitors. Separately, Cloudflare's bot protection may run a background check on your browser and, once passed, set a short-lived cf_clearancecookie so it doesn't need to re-check you on every request — this is a security measure, not tracking, and isn't used to identify you.
Who I share it with
- Cloudflare — hosting, edge functions, Turnstile bot verification, bot protection, and Web Analytics.
- Resend — delivers the email containing your encrypted message. Resend cannot read its contents.
Infrastructure for these providers may be located in various countries.
How long I keep it
Your message is kept only for as long as needed to respond to and resolve your enquiry, then deleted.
Your rights
You can ask me to access, correct, or delete any personal data I hold about you, or object to how it's processed. Contact me using the details below.
Contact
Questions about this policy, or requests regarding your data, can be sent via the contact form. If you've found a security vulnerability, please report it responsibly per my security.txt.