What this site keeps.

The contact form

When you send the form, the server saves your name, your email address, your message, the page you sent it from and the time. It keeps them for 365 days and then deletes them. The deletion runs by itself every day.

A short notification with your name, email and the start of your message comes to me through a notification server I run myself, which holds it for 72 hours. The copy on my phone stays until I delete it.

The whole message also comes to my inbox as an email, with your address set as the one my reply goes to. It's sent by Resend, an email delivery service, which keeps a record of the send under its own privacy policy. The email stays in my inbox until I delete it. Apart from Resend handing it to me, nothing you send is shared, sold or put on a mailing list.

To slow down spam, the server counts how often each IP address sends the form, over ten minutes and over a day. Those counts live in memory only and are never written down.

Server logs

Like almost every web server, this one logs each request, but only what its daily traffic report needs: your IP address, the address you asked for (this site's name and the page, without anything after a question mark), the time, the request method and protocol, how the server answered (the status, the size and the time it took), your browser's user agent, and the page you came from, also cut off at the question mark. Nothing else about the request is kept. The log rolls over at midnight, and each day's file is deleted 30 days after that day ends. The servers' own logs, kept for troubleshooting, note the time and what went wrong, and for a request that failed, its method, protocol, site name and page, again without anything after a question mark. The request details in them leave out your IP address and your browser's headers, and Docker keeps only the latest 30 MB of each server's log.

Once a day a script turns those logs into a traffic report with the last part of every IP address zeroed out. The report stays on the server, isn't published anywhere, and is replaced the next day.

Security reports

If your browser blocks something the site's security policy doesn't allow, it may send a short report naming the page and the blocked resource. When it blocks a script or style written into the page, the report also carries that code's first 40 characters. The server keeps those only when they're the start of the site's own code, which anyone can read anyway. Anything else, a browser extension's code for instance, is stored as a plain marker, and nothing of what it said is kept. Reports don't include your IP address, and the server keeps only the latest 10 MB of them.

In your browser

The site sets no cookies and runs no analytics in your browser. It remembers two things in your own browser: whether you picked the light or dark theme, and, for the current tab only, that you dismissed an update notice. It also keeps copies of its pages so they work offline. You can clear all of that from your browser's settings for this site.

Getting something deleted

Email matt_parker@outlook.com to find out what's stored about you, or to have it deleted before the 365 days are up. I'll delete it and write back to confirm.

If anything on this page changes, the date at the top changes with it.