Privacy

What is collected when you just read

Browsing the public pages requires no account and sets no advertising cookies. The site records aggregate analytics through Microsoft Clarity and Vercel Analytics: page views, referrers, approximate location at country level, device and browser type, and, in Clarity's case, anonymised interaction data such as scroll depth and click positions. That data is aggregate and is used to see which posts are worth writing more of, not to identify you.

Blog post view counts are stored as a single number per post. They are not tied to a visitor, a session or an IP address.

What is collected when you send something

The contact form collects the email address, subject and message you type. That is delivered to my personal inbox through Resend, the transactional email provider this site uses, and your address is used only to reply. The blog subscription form collects your email address so new posts can be emailed to you, and every one of those emails carries an unsubscribe link that removes the address.

Both endpoints apply a short-lived, in-memory rate limit keyed on your IP address to stop them being scripted for spam. That counter lives in server memory, is not written to a database, and disappears when the instance restarts.

Who processes it

Vercel hosts the site and keeps standard server request logs. Microsoft Clarity and Vercel Analytics provide the analytics described above. Resend delivers the contact and subscription email. MongoDB Atlas stores post view counts and subscriber email addresses. Supabase stores the blog content itself and handles authentication for the private applications on this domain. Each of those is used for that purpose only, and nothing is sold, rented or shared with advertisers.

Cookies and local storage

The public pages set no tracking cookies. Your light or dark theme choice is kept in your browser's local storage so the site does not flash the wrong theme on your next visit, and it never leaves your device. Microsoft Clarity sets its own analytics cookies. The private areas of this domain, /fitness and /blog/edit, use Supabase session cookies, but those are only ever set for a signed-in account holder, which is me.

How long it is kept

Contact form messages stay in my inbox for as long as the conversation is useful, and are deleted on request. Subscriber addresses are kept until you unsubscribe, which deletes them. Analytics data follows the retention set by Microsoft Clarity and Vercel and is aggregate rather than personal. View counts are permanent, because they are just numbers.

Your rights

Under UK GDPR you can ask what data of yours this site holds, ask for a copy, ask for it to be corrected, or ask for it to be deleted. For this site that request is short: it is your email address and any message you sent. Ask through the contact form and it will be handled. You can also unsubscribe from post emails yourself at any time using the link in every one of them.

Automated visitors

AI crawlers and agents are welcome on the public pages, and robots.txt names the major ones explicitly. Nothing on those pages is personal data belonging to a visitor: it is my own information, published deliberately. The private applications are disallowed in robots.txt and hold no data about you.

Changes

If what this site collects changes, this page changes with it and the date at the top moves. There is no separate archive of past versions, but the whole site is public and its history is visible in its commits.