Short version: this is a personal site. I don’t sell your data, I don’t run ad networks on it, and most of what gets collected is the ordinary exhaust of running a website. Here’s the specific list.
Analytics
I use Google Analytics, loaded through Google Tag Manager, to see which pages people actually read. It sets cookies and records things like the pages you visit, roughly where in the world you are, and what browser you’re on. I look at it in aggregate — I’m not interested in identifying individual readers, and I don’t try to.
Newsletter
The signup form goes to Kit (formerly ConvertKit), which stores your email address and whether you opened anything. I use it to send The Diff and nothing else. Every email has an unsubscribe link, and unsubscribing removes you from the list — you don’t need to ask me.
Contact form
If you send me a message, it reaches my inbox and stays there like any other email. Name, email address, and whatever you wrote. I don’t add contact-form submissions to the newsletter list.
The agent request log
This one is unusual enough to spell out, because most sites don’t have it.
This site publishes machine-readable versions of its content for AI agents and crawlers — llms.txt, Markdown copies of every page, an MCP server, and so on. When something fetches one of those, the site records what was fetched, when, the User-Agent string, and the IP address. That’s how I know which AI crawlers actually read this site, which is a thing I write about.
It’s a log of automated traffic, not of readers browsing normally, though a request from your browser to one of those files would be recorded too. IP addresses count as personal data under GDPR, so: the log is stored on this site’s own database, it isn’t shared with anyone, and it isn’t used to build a profile of anybody. If you want an entry removed, email me and I’ll remove it.
Hosting, CDN, and server logs
The site runs on Elementor Cloud and sits behind Cloudflare. Both keep their own server logs, including IP addresses, for security and performance reasons — standard for any hosted site. Cloudflare also sets a __cf_bm cookie to tell bots from humans.
Cookies
The ones this site actually sets: Google Analytics cookies (see above), Cloudflare’s bot-management cookie, and a small preference cookie remembering whether you chose light or dark mode. If you log in to WordPress here — which is me — WordPress sets session cookies. There’s no advertising or cross-site tracking.
What I don’t do
No ad networks. No data brokers. No selling or renting anything to anyone. No profile-building. No dark patterns to get your email.
Your rights
If you’re in the EU, UK, or somewhere with similar law, you can ask me what I hold about you, ask for it to be corrected, or ask for it to be deleted. Email me and I’ll do it — there’s no form to fill in and no waiting period beyond however long it takes me to read my email.
Changes
If this changes materially I’ll update this page and note it in the changelog.
Contact
Questions about any of this: use the contact form or email me directly.