What This Site Collects

If you just read the site, nothing about you is stored and no cookie is set. There is no cookie banner because browsing sets nothing to consent to.

If you create an account, four things are stored: your first name, your last name, what you do, and your email address. That is the entire record. You can change it or delete it yourself, from your profile page, at any time.

Creating an account stores your name, your job title and your email address, and nothing else. There is no password, because sign-in works by emailing you a link instead — which also means there is no password of yours here to be stolen.

Your address is confirmed before the account becomes active. Until you click the link in that first email, the record is inactive and receives nothing further.

The data is held in a Cloudflare D1 database in Cloudflare's network. It is not sold, not shared, not used for advertising, and not given to anyone else except the email provider described below, which needs your address in order to deliver a message to it.

Everything held about you is on your profile page. You can edit your name and what you do there, and delete the account outright — which erases the record, every session and every unused link, immediately and with nothing kept in reserve. Your email address is the exception: it is what you sign in with, so changing it needs a new address to be confirmed the same way the first one was. Email me for that.

Two cookies, and only once you are signed in. The first holds a random identifier that stands for your session — no name, no address, nothing readable. It is marked HttpOnly and Secure, so scripts cannot read it and it never travels over plain HTTP, and it expires after thirty days.

The second holds the single character "1" and exists so the page can decide whether to show you a sign-in link or a profile link. It is readable by the page, which is the whole reason it is separate from the first: nothing worth protecting is in it.

Both are strictly necessary for a feature you asked for by signing in, which is why they need no consent prompt. Signing out deletes them immediately, on your device and on the server.

Messages are sent through Resend, which acts as a processor on my behalf and receives your address in order to deliver to it. Their own privacy policy governs what they log about delivery.

You will receive a confirmation email when you sign up, a welcome message once you confirm, and a sign-in link whenever you ask for one. Nothing else is sent to you unless this page says so first.

When you submit the signup or sign-in form, your IP address is combined with a secret and hashed, and only that hash is kept — as a counter, for a few hours, to stop one source flooding the form. The address itself is never written down, and the hash cannot be turned back into it.

Those two forms also carry Cloudflare Turnstile, which is the box confirming you are not a script. It is not a tracker: it sets no third-party cookie, does not use your data for advertising or model training, and does not follow you to other sites. It looks at how the browser behaves on this page in order to answer one question, and your IP address is sent to Cloudflare as part of asking it.

Cloudflare separately processes your IP address in transit in order to serve the page and protect against attacks, under its own privacy policy.

Visits are counted using Cloudflare Web Analytics. It is privacy-first by design: it sets no cookies, writes nothing to local storage, and does not fingerprint your browser or follow you between sites.

It records the page you viewed, the referring site, and coarse technical details such as country, browser and device type. That measurement is sent from your browser to Cloudflare, and your IP address is processed transiently to derive the country. It is not stored by this site and is never made available to me.

Because nothing is read from or written to your device, the ePrivacy Directive's consent requirement does not apply — which is the reason you are not being asked to click anything.

No advertising, no tracking pixels, no marketing or analytics tags beyond the one above, no A/B testing, no session recording, no heatmaps, and no data sold or shared with anyone.

No payment details, no health information, and no profiling: your record is never used to infer anything about you, and nothing here makes an automated decision.

Podcast episode details are pulled from the show's RSS feed when the site is built, not when you visit — so browsing here sends nothing to the podcast host.

Links to Apple Podcasts, Spotify, YouTube, LinkedIn and Patreon lead to services with their own privacy policies. Following one of those links puts you on their terms, not mine.

Episode artwork and guest photographs are served from this domain rather than hot-linked, so viewing a page does not tell those platforms you were here.

The site is hosted on Cloudflare Pages, and the small amount of code behind the account system runs on Cloudflare Pages Functions with a Cloudflare D1 database. Cloudflare processes requests in order to serve pages and to protect against abuse, and keeps its own operational logs under its privacy policy.

Accounts arrived in August 2026, and this page was rewritten in the same change that shipped them rather than afterwards.

The same applies to whatever comes next. If the account record ever grows a field, or your details are ever used for something not described above, this page will say so before that starts — not after.