Privacy

I collect as little as I can, and I would rather explain it than bury it. Vercel Web Analytics counts visits without cookies and without building any picture of who you are, so it runs all the time. Google Analytics and Microsoft Clarity show me how pages are actually used — where people click, how far they scroll — and during the site's first months (until 19 November 2026) they run unless you decline; after that they run only if you accept. What you type into the contact form is masked in Clarity, so it does not appear in those recordings.

What this covers

When you write to me, the form asks Cloudflare Turnstile to check that a person is sending it rather than a machine. It looks at how the browser behaves, not at who you are, and it sets no tracking cookie of mine. Your message is then delivered to me as an email, through a service called Resend, and it stays in my mailbox so that I can reply to it: it is not stored in a database, and it is not added to any list. If you sign up for my writing, that is covered in its own section below. When a letter arrives I record that one was sent — a count, with no name, no email address and nothing you wrote — in Google Analytics and in my own record of enquiries.

If you sign up for my writing

If you give me your email address to receive my writing, I send you one email first, asking you to confirm that the address is yours. Nothing is added to any list until you click the link in it. Each link works once, and only for 48 hours. I then send you my writing occasionally, when there is something worth sending. I do this on the basis of your consent, and you can take it back at any time: every email has an unsubscribe link, or you can write to me and I will take you off myself. The list itself is kept by Resend, the email service that stores your address and sends the emails for me. Resend stores your address and sends the emails from the EU, in Ireland. The emails carry no tracking: I don't record whether you open them or click the links in them.

There is one more record, and I would rather tell you about it than leave it out. When you confirm, and again if you ever leave, the site notes the time against a scrambled form of your address, in a database service called Upstash, in London. The scrambled form is a keyed hash: it is not your address, and your address can't be read back from it. It exists so that old confirmation links are refused once you've unsubscribed or been removed from the list, including if I delete you from it completely. Because its job is to remember that you left, it has no expiry. I keep it on a different footing from the list: not your consent, but my legitimate interest in respecting your leaving. To stop the sign-up form being misused, the site also counts attempts against the internet address you sent from and a scrambled form of your email address. Your internet address is held as it is, only in the memory of the server handling the request, and is used for an hour at most; it is never written to a database, and it goes when that server is recycled.

What you can expect

I don't sell your information, I don't pass it on to anyone, and I use it only to reply to you or, if you've signed up, to send you my writing. If you'd like your message deleted at any point, write and ask — that's a normal request, not an awkward one. You can change your analytics choice at any time from "Cookie choices" at the foot of every page. A fuller privacy notice is being finalised and will be published here.