Privacy policy

Last updated November 4, 2026. This site is run by Carter Cole. Questions or requests: carter@cartercole.com.

What is measured

Server logs (every request). Amazon CloudFront, which serves this site, logs each request: your IP address, the page asked for, the time, the referring page, your browser's user agent, and the country and network (ASN) Amazon derives from the address. I use them to count traffic, including bots and crawlers, and to spot abuse. Cookies are not logged. These logs are kept 30 days.

Anonymous (always on). Each page view adds one to daily counters for the page, the referring site, your country, device size (mobile, tablet or desktop), browser and operating system, and how long the page was on screen. To count unique visitors without a cookie, your IP address and user agent are hashed together with a random value that changes every day and is deleted after two days, so the hash can't be traced back to you afterwards. No cookie is set and nothing identifies you. Visitors sending a Do Not Track or Global Privacy Control signal are not counted.

Error reports. If the site's JavaScript fails in your browser, the error message, the page and your browser's user agent are sent so I can fix it. No identifier goes with it unless you accepted below. They are sent even with Do Not Track, since they say nothing about you.

Full (only if you click Accept). If you accept on the banner, I also collect:

• a random visitor ID stored in a cookie named vid (lasts up to 400 days, renewed when you visit);
• a session ID kept in your browser's session storage until you close the tab;
• a device fingerprint: a hash built from your browser, language, time zone, screen, graphics and similar settings, used to recognise a returning device;
• your IP address and browser (user agent) for each page view, with its country and network;
• the pages you view, where you came from, and a recording of your session: mouse movement, clicks, scrolling and page changes. Text you type into form fields is masked and never captured, and so is your name when you're signed in. Error reports from your visit are linked to it.

Choosing "Anonymous only" or sending Do Not Track or Global Privacy Control means none of the list above is collected. Your choice is remembered in a cookie named consent (one year). You can change it at any time with "Privacy choices" in the footer.

Why

To understand what is read, find problems, and spot abusive traffic. I don't sell the data, use it for advertising, or share it with anyone for their own purposes.

Legal bases

Server logs, anonymous counting and error reports rely on legitimate interests: running the site securely and fixing it. The cookie, fingerprint, per-visit IP records and session recording rely on your consent, which you can withdraw whenever you like. Withdrawing doesn't affect what was collected before.

Accounts

If you sign in with Google, Microsoft, Apple, Slack or GitHub, I receive your name, and where provided your email address and profile picture. They are kept in a signed session cookie (session, 30 days) and are not stored in a database. A second cookie, signed_in, only tells the page to check whether you are signed in. Signing out removes both.

How long I keep it

• Server logs (IP address, user agent, page): 30 days.
• Anonymous counters: 400 days. The daily hashing value: 2 days.
• Error reports: 90 days.
• Visit records (IP, user agent, IDs): 400 days.
• Session recordings: 30 days.

Who handles it

The site and its data run on Amazon Web Services in the United States (Lambda, CloudFront, DynamoDB, S3). Where a network name is shown for an address, it comes from a database copy kept on the server, so your address is not sent anywhere to look it up. Sign-in goes through the provider you choose. No other third parties receive visitor data.

Your rights

You can ask to see, correct or delete what I hold about you, object to processing, or complain to your local data protection authority. Because records are keyed by cookie, I need your visitor ID (the value of the vid cookie, which your browser can show you) or your IP address, and roughly when you visited, to find them. Email the address above; I'll respond within 30 days. California residents: I do not sell or share personal information, and I honour Global Privacy Control.

Children

This site is not directed at children under 13 and I don't knowingly collect their data.

Changes

If this policy changes in a way that matters, I'll update the date above and, if it means collecting more, ask for your consent again.