Privacy
Last updated 3 Aug 2026
This is a personal site. I'm not running ads on it, I'm not building profiles, and I'm not selling anything about you to anyone. What follows is the full list of what gets collected anyway, and how to turn off the parts that are optional.
Analytics
I use Google Analytics 4 to see
which pages and posts people actually read. It tells me things like "the eFoil post got
read this week" and "most visitors arrive from a link on someone else's blog". It sets
cookies in your browser (_ga and _ga_*) that let Google recognize a returning browser,
and it collects your approximate location, device and browser type, referring page, and
the pages you view. Google processes this data on my behalf as a data processor, under
their terms.
If you're visiting from the EU, the EEA, the UK, or Switzerland, none of that happens unless you accept the banner. Until you do, the tag isn't loaded at all: no cookies, and no requests to Google. Everywhere else Analytics loads by default, and you can still decline below.
I also use Cloudflare Web Analytics, which runs at the network level and reports page views and referrers without setting any cookies or storing any identifier that follows you between visits. Because it can't identify you, it doesn't require consent, and there's no way to opt out of it beyond not visiting the site. It's the reason I can turn Google Analytics off entirely and still know roughly how the site is doing.
Change your analytics choice
This works from anywhere in the world, whether or not you were shown the banner. If your browser sends a Global Privacy Control signal, I treat that as a decline and never show you the banner in the first place.
Hosting
The site runs on Cloudflare Workers, and all traffic passes through Cloudflare's network. Like any web host, Cloudflare logs request metadata (IP address, user agent, requested URL, timestamp) to serve the site and to block attacks and abuse. I don't have access to raw request logs, and this processing is necessary for the site to work at all. Their privacy policy covers it.
The contact form
If you use the contact form, the name, email address, subject, and message you type are sent to my inbox as an email. That's the whole mechanism: there's no database, no CRM, and no mailing list. I keep those emails as long as the conversation is useful to me, the same as any other email.
The form is protected by Cloudflare Turnstile, a spam check that replaces the usual "click all the traffic lights" puzzle. It looks at browser signals to decide whether you're a bot, and it doesn't track you across sites.
What's stored in your browser
Two small values, both set by the site itself and neither one used to identify you:
theme, in localStorage, remembers whether you chose light or dark mode.analytics-consent, in localStorage, remembers whether you accepted or declined analytics, so you're only asked once.
Clearing your browser storage for this site removes both. Clearing the second one means you'll be asked again on your next visit.
Embedded video
One post embeds a talk from YouTube using the youtube-nocookie.com player, which doesn't
set advertising or tracking cookies unless you press play. If you do play the video,
YouTube's own privacy terms apply from that point on.
Your rights
If you're in the EU, EEA, or UK, the GDPR gives you the right to ask what personal data I hold about you, to get a copy of it, to have it corrected or deleted, and to object to processing. In practice the only personal data I'm likely to hold is an email you sent me through the contact form, and you can ask me to delete it at any time.
Analytics data isn't linked to a name or an email address, so I generally can't connect it back to you, but you can remove yourself from it going forward by declining above and clearing your cookies.
Getting in touch
Questions about any of this, or a request about your data, can go through the contact form or straight to my email if you already have it. I'm the only person who reads either.
If I change this notice, the date at the top changes with it.