This is a personal blog. For anything about your data, contact me here. I am the controller of the personal data described here.
Every visit
The site is hosted by Cloudflare. As with any website, Cloudflare processes your IP address and basic request details (such as your browser type and the page you asked for) to deliver pages and protect the site from abuse. I don't use this to identify you.
The contact form
What is stored. When you send a message, the site stores:
- your name, if you give one
- your email address
- the subject, if you give one
- your message
- the date and time it was sent
These are kept in the site's database, hosted by Cloudflare in Western Europe, so that I can read your message and reply to it. Only I can read them. Your message is not emailed anywhere, added to a mailing list or shared with anyone.
How long. Messages are deleted automatically 12 months after they are sent. I will delete yours sooner if you ask. Occasional backups of the site's database also contain messages; these are kept for no longer than 12 months.
Your IP address is not stored. To limit the form to 5 messages an hour from any one sender, the site keeps a one-way, keyed hash of your IP address for one hour, then deletes it.
The spam check. The form uses Cloudflare Turnstile to tell people from bots. It runs on the contact page only. Turnstile collects information about your browser and device, and the site sends Cloudflare your IP address to confirm the check. Cloudflare explains what it does with this in its Turnstile privacy addendum. Bots that fill in a hidden field are shown a thank-you page, and nothing they send is stored.
Why. The lawful basis is legitimate interests: replying to people who write to me, and keeping the form free of spam and abuse.
Analytics and cookies
With your consent, the site uses Google Analytics, loaded through Google Tag Manager, to understand how the site is used: which pages are read, how people arrive, and roughly where they are. There are no advertising trackers.
Nothing is loaded until you accept in the cookie banner. If you accept, Google Analytics sets cookies named _ga and _ga_ followed by an ID. The page address is part of what is recorded, and on the search page that includes the words you searched for. The lawful basis for analytics is your consent.
Your choice is remembered in a cookie named klaro for 365 days. To change it, use the Cookie settings link at the bottom of any page.
The site also remembers a few preferences in your own browser: your light or dark theme, whether technical detail is shown, and which parts of a project you have marked as read. These are stored in your browser rather than in cookies, and are never sent to me. Clearing this site's data in your browser removes them.
Who processes data for me
- Cloudflare hosts the site and its database, and runs the spam check. It acts under its data processing terms, which include safeguards for any transfer outside the UK. See Cloudflare's privacy policy.
- Google provides analytics, only if you consent. See Google's privacy policy.
Your rights
You can ask for a copy of the data I hold about you, for it to be corrected or deleted, or object to how it is used. You can withdraw consent to analytics at any time, as described above. Email the address at the top of this page; I'll reply within one month. If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
There is no automated decision-making beyond the spam check, and no marketing.
Last updated: 24 September 2026