What this site collects

There is no analytics service on this site. No Google Analytics, no Plausible or Fathom, no Meta or LinkedIn pixel, no session recording, no A/B testing, and no advertising network. Nothing counts your visit and nothing profiles you.

There are also no third-party embeds. Typefaces are served from this domain rather than from a font CDN, and there are no embedded videos, maps, comment widgets, or social buttons. The practical effect is that loading a page here causes your browser to contact this site and nothing else.

One page stretches that sentence and is worth being precise about. The spinning disc on the about page shows what I last listened to, which means something has to ask Spotify. That request is made by this server, on its own schedule, using my credentials — your browser never talks to Spotify, and Spotify is never told that you visited. What reaches you is a track name this site already had.

This site sets no cookies for visitors, and there is no cookie banner because there is nothing to ask you to consent to.

One cookie exists, and it is not for you: signing in to the content management system at /admin sets a session cookie so the site owner stays signed in. It is only ever set after a successful login, and if you have never logged in you will never receive one.

Serving a web page requires receiving a request, and the server records those requests. Such logs include your IP address, the page you asked for, the time, and your browser’s user agent string. This is standard for every website on the internet and is used to keep the site running and to investigate abuse — not to build a profile of you.

Who holds them is the part worth being specific about. This site runs on a server I rent from DigitalOcean and administer myself, so the logs sit on a machine I control rather than inside a platform keeping its own copy under its own terms. DigitalOcean provide the hardware and the network that server runs on, which is what makes them the one company your request physically passes through; they have their own privacy policy.

The logs are not combined with anything else, not shared onward, and not kept indefinitely — they rotate and are discarded.

The address on this site is an ordinary mailto: link — there is no contact form, so nothing you type is submitted to this site or stored in its database. Clicking it opens your own mail client.

If you do send an email, then I have your email: your address, your name if you sign it, and whatever you wrote. It stays in my mailbox, it is used to reply to you, and it is not added to a mailing list. There is no mailing list.

The site runs on a content management system with a database, and that database holds the site’s own content — writing, projects, and uploaded images — along with one administrator account belonging to the site owner.

It holds no visitor records of any kind. There are no accounts to register for, no comments to post, and no way for a reader to write anything into it.

That database is hosted by MongoDB Atlas rather than running on the same server as the site, which makes them a third company in this picture and worth naming rather than leaving implied. What they hold is the site’s content and its single administrator login. There is no visitor record in there for them to hold, because the site never creates one.

The data sits in the United States, and MongoDB Atlas keep it under their own privacy policy.

No data from this site is sold, rented, traded, or handed to advertisers or data brokers. There is no arrangement of that kind and none is planned.

The complete list of outside companies involved in this site runs to three, and none of them is given anything about you. DigitalOcean rent me the server your request arrives at. MongoDB Atlas host the database that server reads the writing out of. Spotify tell that server what I last listened to, without ever being told that you are reading this.

If you are in the UK or the EU, the GDPR gives you the right to ask what personal data is held about you, to have it corrected or deleted, and to object to its processing. If you are in the United States, whether a law grants you those rights depends on your state; this site is run from Alabama, which has a breach notification act but no comprehensive consumer privacy statute of its own.

None of which changes what happens when you ask. Everyone gets the same answer wherever they are, because sorting readers by jurisdiction in order to give some of them fewer rights would be more work than simply honouring the request.

Those rights are unusually easy to exercise here, because in almost every case the answer is that nothing is held. If you have emailed me and would like that correspondence deleted, say so at elijahmivedor@gmail.com and it will be.

This site is not directed at children and knowingly collects no information from anyone, of any age.

If this site ever gains analytics, a newsletter, comments, or anything else that touches visitor data, this page will be updated to say so before that change ships, and the date at the top will change with it.

Questions about any of this go to elijahmivedor@gmail.com.