Privacy

The short version

This is a personal portfolio run by one person. It counts visits to understand which writing is worth continuing. It does not run advertising, does not build profiles, does not track you across other sites, and has no third-party trackers beyond the optional Google Analytics described below.

If you decline the cookie prompt, nothing is recorded at all — no identifier is stored, no page views are sent, and no analytics script is loaded. The choice is remembered so you are not asked again.

What is collected, and only after you accept

When you accept, each page you visit sends a single request recording the following. None of it identifies you personally.

• A random visitor identifier. A random value generated in your browser and stored in a first-party cookie. It is not derived from your device, so clearing the cookie genuinely resets it. It distinguishes a returning visit from a new one and nothing more.
• The page path you viewed, and how long you were on it.
• Session grouping. Views within thirty minutes of each other are treated as one visit.
• Browser and operating system, with the major version only — “Firefox 142”, never the full version string. The precise version is a fingerprinting signal and answers no question worth asking.
• Device category (desktop, mobile or tablet), window size, language and time zone, as your browser reports them.
• The referring site, if you arrived from an external link.
• Country, derived from the network address your request arrives from.

What is deliberately not collected

• Your location. The site never calls the browser’s geolocation API and will never ask for that permission. Country is inferred from the network, at country granularity only — never a city, an address or coordinates.
• Your IP address. It is used in memory to work out a country and a rotating daily hash, then discarded. No database column stores it, and none ever has.
• Device fingerprints. No canvas, font, audio or hardware probing. The identifier is random rather than derived, which is the difference between a cookie you can clear and a fingerprint you cannot.
• Anything you type — other than what you deliberately send through the contact form.

Cookies

Declining deletes mw_vid and clears any Google Analytics cookies. You can also clear cookies for this site in your browser at any time, which resets everything — including the prompt.

Google Analytics

Where a Google Analytics measurement ID is configured, its script is loaded only after you accept, never before, and IP anonymisation is enabled. Google processes that data under its own terms. If you decline, the script is never downloaded.

Messages you send

If you contact the site owner through a form on this site, the name, email address and message you type are stored so they can be read and replied to, along with the page you sent it from and the country of the request for spam triage. It is not added to any mailing list, is never shared, and is deleted on request.

Google account access (the site owner’s own account)

This site has a private administrative dashboard used by its owner alone. That dashboard connects to the owner’s own Google account to display their mail, calendar, tasks and site analytics in one place.

This does not involve visitors. No visitor signs in, no visitor’s Google data is requested, and access is restricted to a single pre-authorised address — any other account is refused before a session is created.

The permissions requested, and what each is used for:

• Gmail (read and modify) — to list messages the owner has starred or Google has marked important, and to star, mark read or archive them. It cannot permanently delete mail and never sends any.
• Calendar — to show the week ahead and create or remove the owner’s own events.
• Tasks — to list the owner’s tasks and mark them complete.
• Analytics (read only) — to show traffic figures for this site.

Access tokens are held encrypted on the server and are never sent to any browser. Message contents, calendar entries and tasks are read on demand to render a screen and are not copied into the application’s database. Access can be revoked at any time from the dashboard or at myaccount.google.com/permissions.

Limited Use

This application’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide the features described above, is never transferred to third parties, is never used for advertising, and is never used to train generalised artificial intelligence or machine learning models. No human reads it except the account’s own owner.

Where the data lives

Analytics and content are stored in a PostgreSQL database hosted by Supabase; the API runs on Render and the site on Vercel. Uploaded images are stored in Supabase Storage. These providers process data on the site owner’s behalf.

How long it is kept

Analytics records are kept in aggregate for as long as they remain useful for understanding what to write next. Contact messages are kept until they are dealt with and deleted on request. The daily visitor hash is meaningless after the day it was created, by design.

Your choices

• Decline the cookie prompt, and nothing is collected.
• Clear this site’s cookies to reset your identifier and be asked again.
• Ask for a copy of anything held about you, or for it to be deleted, using the contact details below.
• Browser “Do Not Track” and global privacy signals are respected where sent.

Changes

If what is collected changes materially, this page changes with it and the date at the top is updated.

Contact

Questions about any of this, or a request to see or delete your data, can be sent to the address in the site footer. Requests to delete data are honoured without needing a reason.