# Privacy This site sets **no cookies**, loads **nothing from a third party**, and runs **one small script of our own** — no analytics tag, no tracking pixel, no embedded fonts or scripts from anyone else's server. There is no consent banner because there is nothing to consent to. Everything you see was built into a plain HTML page before you asked for it. That one script filters the list on the portfolio page while you type. It sends nothing anywhere, keeps nothing between visits, and is the only thing here that runs in your browser at all. Where it cannot run, the search box is not shown — you get the whole list instead. That is not a policy we promise to keep; it is how the site is made. You can check it: view the source, or open your browser's network panel and watch which servers it talks to. The answer is one — ours. ## What the server records Our web server keeps an access log, the way essentially every web server does. It is the only way we can tell which pages people read, and whether anyone finds their way to the contact page. One piece of configuration writes every log on that server, so each address that records anything records it the same way, and that is more addresses than there are pages to browse: seven today — this site, the `www.` version of it, our `git.` subdomain, three short addresses that redirect here (one for each of our own names, and one for this page), and the host that serves nothing but our mail policy. For each request it stores: - **The page requested**, and the date and time. - **Whether it worked** — the response status, so we can find broken links. - **Your browser's self-description** (the "user agent"), which is how we separate people from search-engine crawlers. - **The site you came from**, if you followed a link — see below. - **A blurred network address** — see below. ## Two things worth being precise about **Your IP address is never stored in full.** It is shortened at the moment the line is written, not cleaned up afterwards: the last part is replaced with zeroes before anything touches the disk. What remains identifies a rough network, not a person or a household — an entire office and an entire street can look identical. The server records the address under two names and masks both, and it drops the headers that can carry an address of their own — the ones a company proxy or a content delivery network puts in front of you — before the line is written. What reaches the disk is that rough network, which is not much to lose, hand over, or be asked for. **We do keep the site you came from, and that is a real disclosure.** If you arrive by clicking a link, your browser tells us which page it was, and we keep the site's name — `example.com`, not the full address of the page, and never anything after the `?`. We keep it because it is the only way to know whether anyone finds us at all, and from where. We would rather write that plainly here than collect it quietly. ## How long, and who sees it A line lives about **thirty days**, and since September 2026 that is true of every address rather than only the busy one. Two things enforce it. A log file is rotated when it reaches about **10 MB**, and a rotated file is deleted once fourteen newer ones exist or it turns thirty days old. That alone left the quiet addresses untouched — they fill 10 MB so slowly that their file had never been rotated at all, so it still held every line since we switched logging on. So a job now runs once a day and closes any file whose oldest line is more than a day old, then deletes the closed ones after thirty days. Four of our seven addresses were in the old state until we fixed it, and we would rather write that down than quietly improve it. Summaries outlive the log, and we would rather say so than let you find out. A program on the server reads the log and prints counts; the counts travel to our own computer, where the summaries are written and kept in a private repository of ours. Each address has four of them — the last thirty days for people, the same for everything automated, a row per day and a ranking per month — plus a page for each month and each year. They are written afresh on every run and the repository keeps its history, so every earlier edition of them stays too. **A daily tally**, kept indefinitely: so many pages read, so many of them by crawlers, so many reaching the contact page. Dates and counts, nothing else. **A monthly ranking**, also kept indefinitely: which pages were read most that month, which sites people arrived from, which crawlers and automated scanners called, and which blurred networks the automated probes came from — each as a name and a number of times. It is how we can still answer "what did people read last March" once March's log is gone. What that ranking is not: it is never a record of what any one visitor did. A page has a count beside it and nothing else — not who asked for it, not when beyond the month, not what else they read. The lines are never joined back together, because the pieces needed to join them are not kept. Nothing is copied to any other company, and there is no analytics account anywhere holding a shadow copy. What leaves the server is those counts, and they go to a machine of ours. **The other ways in.** This site is also served over Gemini and Gopher, two older protocols with no access log at all, and over Tor. Since September 2026 we count **how many requests** the Gemini and Gopher copies answered on each day, and nothing else: no address, no page, no visitor. **We count nothing at all over Tor**, and there is no setting that would let us — knowing who read an onion address is the one thing that protocol exists to prevent, and we would rather not know than be able to. Counting them showed us something we had not known, so here it is. The Gopher copy is started afresh for each visitor by the operating system, which names that moment after **the address it came from** and writes the name into its own log. Our server software never sees it and no setting of ours could have stopped it. We found it the day we first counted, and that log now expires after thirty days like everything else here. It was keeping things for longer. **Where our own server is.** One machine, in Toronto, Canada. The log is written there and stays there; the summaries are written from it on our own computer. The [credits page](/credits/) names the server, along with everything else this site is built on and served by. We do not build profiles, and we cannot follow you across other websites. For as long as a line is in the log it carries no name, no email address, no cookie and no complete address. It does carry your browser's full self-description, a blurred network, the language your browser asks for and a timestamp to a fraction of a second, all on one line. A rare browser on a small network narrows that down further than we would like, so we write it here rather than tell you that identifying you is impossible. ## Getting in touch Mail sent to [welcome@engineer.company](mailto:welcome@engineer.company) is read by us and kept in our own mailbox, hosted with Apple iCloud. We use what you write to answer you. We do not add you to a mailing list, and there is no mailing list to add you to. If you want to know what we hold about you, or want it removed, write to the same address and we will answer honestly — which, given the above, will usually be "nothing that identifies you". Questions this page does not answer go to the same place — [ask us directly](/contact/) *(read by a person, not a pipeline)*.