Privacy

The newsletter

If you subscribe using the form on this site or on /subscribe, your email address goes directly to Buttondown — the service that sends these letters — and nothing is stored on this site itself.

Buttondown's retention rule is written in terms of accounts, and the account it means is mine — the one that sends these letters — not yours as a subscriber. Their policy doesn't set out a separate retention period for subscriber addresses, and it doesn't promise yours is erased the moment you unsubscribe.

Every letter carries a working unsubscribe link — Buttondown adds one automatically — and using it stops the letters right away. It doesn't necessarily erase your address on the spot, though: Buttondown's own documentation describes an unsubscribe as a status change rather than an outright deletion, specifically so a later re-import of an old list can't quietly resubscribe someone who opted out.

Every letter also carries a small mark image, hosted here rather than at the newsletter service — so opening the letter makes your mail program fetch it from this site, and Cloudflare serves that request the way it serves any page here. That is the same mechanism a tracking pixel uses, so I'll say plainly what I do with it: nothing. No code here reads or counts those requests, and the analytics described below can't see them either — that's a script that runs on web pages, and loading an image runs no script. Whether Cloudflare keeps ordinary server logs of that request is theirs to answer, not this site's.

Buttondown also publishes its own list of the outside services it uses to run the platform — Cloudflare, Google Workspace, Heroku, Mailgun, Plain, Postmark, Seline, Sentry, Slack, Stripe, and Twilio, per their subprocessor list ; see their own privacy policy for the rest.

The contact form

If you use the contact form, it collects your name, email address, subject, and message, and sends them to Web3Forms — a third-party form processor — which delivers them to my inbox at uneqpd@gmail.com. Nothing is stored on this site. Web3Forms' own published policy keeps form submissions for up to three years from submission before automatic deletion (their dashboard, which I use to look up recent submissions, shows only the most recent 30 days on my plan — a shorter, separate figure from that three-year bound); see their privacy policy for the rest. Web3Forms processes submissions through Amazon Web Services, Cloudflare, and Hetzner, and operates from India — a submission may be transferred outside the EEA/UK/Switzerland under their published safeguards. To catch spam, they may also share a submitter's IP address and email address with CleanTalk and Akismet.

Comments

Journal entries can carry a comment form — other sections will too, once they open. It collects the name and text you type, and — only if you choose to give it — an email address used solely to tell you if someone replies; it also notes which entry, and which comment if any, you're responding to. That data goes to Web3Forms the same way the contact form's does (see above), which delivers it to my inbox. Nothing is stored on this site by the form itself.

I read every comment by hand and publish some of them by committing a file to this project — nothing else can make a comment appear. Approved comments are held in this project's own files, which are not publicly readable (unlike the comment itself, once published, which is). If you ask me to take a published comment down, I will remove it from the live site at the next update; a copy may still exist in this project's private history unless that history is separately rewritten. Your email address, if you gave one, is never published and never enters this project at all — it exists only in the notification email in my inbox.

Spam protection (hCaptcha)

The contact form and the comment form both use hCaptcha to keep bots out — for comments, it only loads once you open the "Write a comment" form, never while you're just reading. Completing the challenge may share some technical data with Intuition Machines (the company behind hCaptcha) to verify you're human. See their privacy policy .

Analytics

This site uses Cloudflare Web Analytics. I collect analytics for two reasons: I want some sense of the audience this reaches — roughly where in the world people are reading from, and on what kind of device — and I want to know how the site performs for them, which pages get read and whether they load quickly. Cloudflare already serves this site, so the measurements go straight to it; there is no separate analytics company in the middle.

It is cookieless. The script sets nothing in your browser and reads nothing from it — no cookies, no localStorage, no sessionStorage. What it records is page-level: which page was loaded, roughly which country the request came from, the browser, device type and operating system, what referred you if anything, and how long the page took to load. It does not log the query string on a URL, and Cloudflare's published position is that it does not track individual visitors across the sites that use it. Your IP address reaches Cloudflare the way it reaches any web server, as part of the request; Cloudflare says it is discarded at the edge and not stored. See their privacy policy for the rest.

None of this is ad tech, there are no tracking cookies, and nothing here is trying to work out who you personally are.

Your browser

The only thing stored in your browser is your light/dark theme preference, saved in localStorage on your device. That's it.

Questions

Anything unclear? Use the contact page.