What this site collects.

Every page loads Google Analytics 4, property G-6XSD617MVR. It records that a page was viewed, which page, roughly where in the world the visit came from, what kind of device and browser it was, and which site or search you arrived from. It does not record your name, and I have no way to tie a visit to a person.

It works by setting two cookies in your browser, _ga and _ga_6XSD617MVR, which hold a random identifier so that four pages read in one sitting count as one visit rather than four. They last two years unless you clear them.

Google processes this on my behalf and keeps it for the window the property is configured for, after which it is deleted. Google states that it uses the IP address of a request to work out the approximate location and then discards it rather than storing it. Google's own account of what it does with analytics data is in its privacy policy.

Nothing on this site loads an advertising tag, a remarketing pixel or a conversion tracker. I use the numbers to see which pages get read and which searches bring people here, which is the same work I do for clients.

There is no cookie banner. Asking permission with a banner that most people dismiss without reading is worse than saying plainly what runs and telling you how to stop it, which is the next section.

Any of these stops it, and none of them break the site:

• Google publishes a browser add-on that blocks Analytics on every site, at tools.google.com/dlpage/gaoptout .
• Blocking the domain googletagmanager.com in a content blocker or in your hosts file has the same effect. Most ad blockers already do it.
• Browsing in a private window, or clearing cookies afterwards, means the identifier does not persist between visits.

Analytics does not honour the browser Do Not Track header, so switching that on will not help. I would rather tell you that than let you assume it works.

The form on the contact page asks for a name, an email address and a note. Submitting it posts those three fields to Web3Forms, which emails them to me. They handle the submission on my instructions rather than for their own purposes, and their own policy is worth reading if the detail matters to you, because it is more than a relay:

• They keep submission data for up to three years, then delete it automatically. So a copy can sit on their systems after the conversation is over, and deleting the email from my inbox does not delete theirs.
• Their infrastructure is Amazon Web Services, Cloudflare and Hetzner, and the company operates from India, so a submission leaves the country you sent it from. Their data processing agreement covers those transfers with standard contractual clauses.
• To filter spam they may pass the sending IP address and email address to CleanTalk or Akismet. That is the one part of sending the form that hands your details to a company neither of my choosing nor mentioned on the form itself, which is why it is written down here.

Once it arrives it is an email, and I treat it like one. I reply to every note myself. The message stays in my mail while the conversation is live and for as long as the work it led to needs a record. If you would rather it did not, say so and I will delete it, and ask Web3Forms to drop their copy too.

There is a hidden checkbox in the form that only automated submissions fill in. Anything that ticks it is dropped. That is the only thing in the form you are not shown.

No mailing list exists. Nothing you send is added to one, and I send no marketing email, so there is nothing to unsubscribe from.

The site is static files served by Vercel, which keeps request logs for its own operations and security. Those logs include IP addresses, as all web server logs do. I do not read them for anything other than working out whether the site is up.

The fonts are served from this domain rather than from Google Fonts, and there are no embedded videos, maps, chat widgets or social buttons. So apart from Analytics and the contact form, loading a page here contacts no one but Vercel.

• I do not sell or share your information. There is no one to sell it to.
• I run no advertising, so nothing here builds an audience for retargeting.
• I do not use fingerprinting, session recording or heatmap tools.
• I do not track you across other sites, and I cannot.
• I ask for no account, so there is no password and no login to breach.

Email hugo@hugopegley.com and I will handle it myself. You can ask what I hold, ask for a copy, ask me to correct it, or ask me to delete it. I will do it within a month and usually the same week. There is no form for this and no ticket queue.

If you are in California, the rights the CCPA gives you apply, including the right to know what is collected and the right to have it deleted. The right to opt out of sale is moot here, because nothing is sold. If you are in the United Kingdom or the European Economic Area, treat the analytics section above as the disclosure the GDPR asks for, and the same email address as the way to exercise any of those rights.

One limit worth being honest about: analytics data holds no identifier I can connect to you, so if you ask me to delete your analytics record, I have no way to find it. Clearing the cookies in your browser is the only thing that severs it, and it severs it completely.

If what the site collects changes, this page changes in the same commit that changes it. The date at the top is the date of that edit. I will not quietly widen what is collected and leave this page describing the old version, and if you ever find the two out of step, that is a bug worth emailing me about.