Privacy

The short version

• No analytics of any kind. I do not know how many people read this page, and that is a deliberate choice.
• No cookies. Not for preferences, not for statistics, not for anything.
• No third-party requests. Fonts come from your operating system, and every asset is served from this domain.
• Server logs are kept for 14 days and then deleted. They exist to catch abuse, not to profile readers.
• If you subscribe to the newsletter, your address is used to send you the newsletter and nothing else.

If you would like the details, keep reading. If you would like to exercise a right, the contact details are at the bottom.

What is collected automatically

Like every web server, the one running this site writes a log line for each request. That line contains the IP address the request came from, the browser's user-agent string, the URL requested, the referring page if your browser sent one, and a timestamp.

• Why: to detect and block abuse — credential stuffing attempts, scraping floods and the occasional botnet. This is the only purpose.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR) in keeping the service available and secure.
• Retention: 14 days, after which log files are rotated out and deleted. Aggregated counts of requests by status code are kept longer, but those contain no IP addresses.
• Who sees it: me, and the hosting provider as a processor. Nobody else.
• What it is not used for: profiling, advertising, product decisions, or any form of audience measurement.

Cookies and local storage

This site sets no cookies. There is no cookie banner because there is nothing to consent to.

One thing is stored in your browser's localStorage: the theme you picked, under the key ev-theme, with the value light or dark. It never leaves your device, it is not a cookie, and it is not sent to the server. Clearing your browser storage for this site removes it, and the site falls back to your operating system preference.

Third-party requests

There are none. Specifically:

• No webfonts. Typography uses the fonts already on your device, so no request goes to Google Fonts or anyone else.
• No CDN, no analytics script, no A/B testing tool, no chat widget.
• No embedded media. No YouTube, no Vimeo, no social embeds — nothing that would phone home when a page loads.

Links to other sites are just links. Nothing is requested from them unless you click, and once you are there their privacy policy applies rather than mine.

If you subscribe to the newsletter

The email list is hosted by a small European provider acting as a data processor, on the basis of your consent (Article 6(1)(a) GDPR). Subscribing is double opt-in: you get a confirmation email, and nothing is sent until you click the link in it.

• Your address is used to send the newsletter and nothing else.
• It is never sold, rented, shared or added to any other list.
• Automated open and click tracking is switched off. I get a count of subscribers and nothing more.
• Every issue has a one-click unsubscribe link. Unsubscribing deletes your address within 30 days.

If you send me a message

Messages sent through the contact form or by email are stored so I can reply and so I can remember what we discussed. The message body, your name, your email address and anything else you include are kept for 24 months, then deleted. The legal basis is legitimate interest in conducting business correspondence, or the steps taken at your request before entering into a contract.

Contact form submissions are sent to me by email. They are not stored in a database, not used for marketing, and not shared with anyone outside my own tooling.

Your rights

Under the GDPR you have the right to:

• ask what personal data I hold about you, and receive a copy;
• have inaccurate data corrected;
• have your data erased, where no legal obligation requires me to keep it;
• receive your data in a portable format;
• object to processing based on legitimate interest;
• withdraw consent for the newsletter at any time, without affecting anything that happened before you withdrew it;
• complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Email me and I will respond within 30 days, usually much sooner. I will not ask you to prove your identity beyond what is necessary to find the data you are asking about.

Where the data lives

The site is served from a single server in Germany (Hetzner Online GmbH), inside the EU. Email is handled by Fastmail, which stores data in Australia and the United States; if that matters for your organisation's compliance review, tell me and we can use another channel for our correspondence. No personal data is transferred anywhere else.

Controller

Elliot Vance, Rotterdam, the Netherlands. For any privacy question, or to exercise any of the rights above, write to hello@elliotvance.dev. Mention "privacy" in the subject line and it will get dealt with first.

Changes to this page

If this policy changes in a way that affects you, the change will be described here with a date rather than quietly edited in. The current version has been in force since 27 April 2025. Previous versions are available on request, which sounds more formal than it is — I keep this file in version control like everything else.