Privacy

This site counts visits without cookies and without knowing who you are. Here is what it collects and where that goes.

Last updated

The short version

  • The site sets no cookies.
  • Visit counts carry no name, no email address and no account. The site never calls PostHog's identify.
  • Each reader gets a new anonymous id every day, so I cannot follow a reader from one day to the next.
  • The site shows no ads. I do not sell your data and I do not share it for anyone else's use.
  • If you join the email list, I keep your address until you unsubscribe, then delete it. I delete an address if you do not confirm it within 7 days.

Visit counts

I count visits with PostHog Cloud in the United States. The analytics code writes nothing to your browser: no cookies, no local storage.

Your browser does not talk to PostHog. It sends events to this site, at /e/. The site's server passes them on to PostHog and removes cookies in both directions.

To tell readers apart for one day, PostHog builds a hash. Its inputs are your IP address, your browser's user-agent string, this site's host name, my PostHog project and a salt that changes every day. My server passes your IP address on for this hash, along with the other request headers, minus cookies. PostHog looks up no location from your IP address. Because the salt changes, the same reader gets a different id the next day.

What every page view sends

  • The page address, host name and path.
  • The page title.
  • The page that sent you here, its domain, and any campaign tags or ad click ids in the address, such as utm_source or fbclid.
  • Your browser and version, operating system and version, device type and model, language and time zone.
  • Your screen size and the size of the browser window.
  • The user-agent string and the version of the analytics library.
  • When you leave a page: how long you stayed and how far you scrolled.

What the site adds

  • A click on a link that leaves the site. It sends the host name of the link.
  • A click on a Next lesson card, a Seen in real code link or a button to another page. It sends the kind of link and where it points.
  • Scrolling through a lesson. It sends the lesson name and 25, 50, 75 or 100 percent, once each.
  • First use of an interactive demo. It sends the lesson name.
  • Opening a Check yourself answer. It sends the lesson name and the number of the answer.

Each of these events also carries the page address and the browser details listed above. None of them hold text you typed or chose. I turned off autocapture, session recording, heatmaps, surveys, error capture and feature flags.

Cookies and storage

The site sets no cookies. If you use the light and dark switch, your browser keeps that choice on your device. It is never sent to me. Pages load no scripts, fonts or images from other sites.

Hosting

Cloudflare serves the pages. Like any host, it sees each request: your IP address, the page you asked for and your browser's details. Cloudflare keeps its own logs under its own terms.

The email list

The list is not open yet. When it opens, it works as described here, and the date at the top changes.

If you join the list, I store three things in a Cloudflare D1 database: your email address, a hashed confirm token and timestamps. Your address stays pending until you click the link in the confirm email. If you do not confirm within 7 days, I delete it.

Resend sends the confirm email and later messages, so Resend receives your address and the messages. Every email has an unsubscribe link. Unsubscribing deletes your row. You can also email hello@spicyshark.co and ask me to delete it.

To slow abuse, the sign-up form limits how often one network can send a request. It checks a hash of the IP address, not the address. That hash is kept for about a day.

The database host keeps point-in-time backups, so deleted list data, the IP hashes included, can stay in those backups for up to 30 days.

The emails contain no tracking pixels. Links in them carry utm_source=newsletter, so the visit count can show that a visit came from an email.

Mail you send me

Mail to hello@spicyshark.co passes through a forwarding service, addy.io, before it reaches me. I use your address and message to reply. I do not add you to the email list.

Questions

Write to hello@spicyshark.co. When this page changes, the date at the top changes too.