---
title: "Privacy"
description: "What this site keeps about you, who can see it, how long it lasts, and how to have it removed."
published: 2026-08-30
updated: 2026-08-30
author: "Jacques Thibodeau"
canonical: "https://jacquesthibodeau.com/privacy/"
---
This page says what this site keeps about you, who can see it, how long it lasts, and how to have it removed. It is written to be checked against the code rather than to sound reassuring, so where something is stored twice, or where I can read something you cannot, it says so.

Short version: I keep as little as I can get away with. There is no advertising, nothing is sold or shared, and the only cookie this site's own code sets is a sign-in cookie you get by choosing to reply. Google Analytics sets cookies of its own, and the next section says so properly.

## Reading a page

Nothing is asked of you and nothing about you is sent anywhere by the page itself. The pages are static files.

Your browser does remember a few things, all of them on your own device and none of them ever sent to me. Your theme, whether link marks are grey or coloured or hidden, whether the reading bar is on, where you stopped in a narrated post, an answer you typed into an interactive figure, and a reply you started writing and have not posted. Clearing site data in your browser clears all of it.

Two things do see your visit.

**The web server keeps an access log.** Every request records the time, the page, your browser's user agent, and your IP address. It is the ordinary log a web server writes, it lives on the server and nowhere else, and I use it to know whether the site is up and roughly how many people read something. One page is an exception: requests to `/proposal/` are logged with the address blanked, because that page has been shared with about ten named people and an address plus a time would often say which one. Cloudflare sits in front of the server and also sees every request, under [its own privacy policy](https://www.cloudflare.com/privacypolicy/).

**Google Analytics is on the site.** It is the property `G-0D6B5GVK8F`, and it has been collecting since the site ran on Ghost. It tells me which pages get read and roughly where readers are, and it sets its own cookies, under [Google's privacy policy](https://policies.google.com/privacy). `/proposal/` is left out of it for the same reason the log blanks the address there. If you block trackers you are simply not in it, and a large share of the people who read this site do block them.

I have no way to connect either of those to a name.

## The newsletter

If you subscribe, [Buttondown](https://buttondown.com/legal/privacy) holds your email address and its own record of which emails you opened. That is a separate service under its own policy, and unsubscribing is a link at the foot of every email. I do not sell or share the list, and I do not use it for anything except sending the newsletter.

## Replying to a post

As of 30 August 2026 this is not switched on. No post has a reply box, nothing described in this section is running, and no reply and no address exists to store. The section says what will be true when I turn it on, and if you are reading it under a post that has a reply box then it is on.

Replies are open to people on the newsletter. There is no account and no password. You type the address you get the newsletter at, and if it is on the list you get a one-time link by email that signs you in.

**What is kept, exactly.** The address you signed in with, the display name you chose, the text of your reply, the time, and which post it was on. Your address and your display name once more in a small table of their own, which is what makes the name yours from your first reply onward. A record of your sign-in, so you do not have to do it again for ninety days. A record of the sign-in link itself, so it can only be used once. If I ever block you, your address in plain text with the date and my reason.

No IP address is stored with a reply, no user agent, no referrer. Two counters exist to stop somebody flooding the box: one is a scrambled version of your address and lasts a day, one is a scrambled version of your IP address and lasts a quarter of an hour. Both are one-way scrambles, neither is ever written to the database with your reply, and both delete themselves.

**Your name on a reply.** You choose it the first time you reply, and after that it is yours: it is kept against your address, it goes on every reply you write, and the box stops asking. Two reasons, and the second one is the important one. It means a name on this site means one person. And it means nobody can sign a reply with mine, because my own name is kept for my own replies and my replies carry the word "Author" beside them, which is set by the site and not by whoever is typing. If you want your name changed, email me and I will change it everywhere you have used it.

**Who sees what.** Your display name and the text of your reply are public, on the page, to anyone. Your email address is not shown anywhere and is not sent to anyone reading the page.

Three parties can see your address. I can. [Cloudflare](https://www.cloudflare.com/privacypolicy/) can, because the replies live in a Cloudflare database. And [Resend](https://resend.com/legal/privacy-policy) can, because it is the service that sends the sign-in link to you and the notification to me, and that notification carries your address and the text of your reply. Nobody else.

I keep the address rather than a scrambled version of it for one reason: if I have to stop somebody replying, I have to be able to tell who they are, and the name on a reply is not enough to do that. That means your address is in more places than one. It is at Buttondown, it is in the reply database, it passes through Resend, and while you are signed in it is on your session too. That is a real cost and it is the reason this paragraph exists rather than a sentence about taking privacy seriously.

**How long.** All of these are the longest it can be, and every one of them can run up to a day over, because the job that does the deleting runs once a night rather than continuously.

- A reply, and the address on it: until it is deleted. Deleting a reply hides it from the page immediately, and erases the row and the address thirty days later. The thirty days are so that a reply I removed by mistake can be put back. If you want yours gone now rather than in thirty days, ask, and it is one command and it is gone.
- Your sign-in: ninety days, then a week's grace so that coming back on day ninety-one tells you your sign-in expired rather than nothing at all. Ninety-seven days in total, or until you sign out.
- The sign-in link: fifteen minutes to use it, and the record of it is deleted the next night.
- A block: until I lift it. If you ask to be forgotten and you are blocked, the block keeps your address, because a block I cannot read is a block I can neither check nor undo. Ask me to lift the block as well and that copy goes too.

**Cookies.** One from this site's own code, and only after you sign in. It is called `atf_c`, it lasts ninety days, it holds nothing but a random identifier and a signature over it, and it is scoped so narrowly that your browser only sends it when the page is actually talking to the reply system. It is not used to follow you anywhere, on this site or off it. Signing out removes it. If you are signed in somewhere you no longer have, "sign out everywhere" in the reply box ends every sign-in on every device at once, and you do not have to ask me to do it. Google Analytics sets cookies of its own, which is a separate thing and is in the reading section above.

**The sign-in link.** It works once and expires in fifteen minutes. If your mail provider scans links, its scanner may use the link before you do, in which case you will be told it has already been used and can ask for another.

Anyone who can read your inbox can reply as you. That is true of every sign-in link anywhere, and there is no way to design it away without adding a password, which would be a worse trade for everybody. What this site does instead is tell you: every reply posted under your address sends you a copy of it, at that address, the moment it is posted. If one arrives that you did not write, write back and I will erase it and stop that address posting again, and you should change the password on your mailbox, because whoever posted it can read everything else in there too.

**Asking for the same thing twice.** When you enter an address, the answer is always the same sentence whether or not that address is on the list. That is on purpose. If the site said "you are not subscribed", the box would become a way for anyone to find out who is on my mailing list, one address at a time.

## Having it removed

Write to me and say what you want gone. A reply, everything you have ever written, your address, your place on the newsletter, all of it. I will do it and tell you when it is done. You do not have to give a reason and I will not ask for one.

Two things about that are worth being exact about, because they are the parts a promise usually glosses.

Erasing your replies and your address from this site is a command I run, and it deletes the rows rather than hiding them. It does not take you off the newsletter, because the newsletter lives at Buttondown and that is a separate thing with its own unsubscribe link. If you want both, say so and I will do both.

Where to write: reply to any email you have had from the newsletter. That reaches me, and it is the surest route. The copy this site sends you of your own reply names an address to write to as well, and the footer of this site carries my email address whenever I have one published there.

## What this site does not do

No advertising. No advertising cookies. No third-party embeds in the reading column. Nothing sold, nothing shared, no profile built about you, no attempt to work out who you are across sites. The reply database holds no IP address and no user agent anywhere in it, and the only thing anywhere in the reply system that comes from your IP address is the counter described above, which is a one-way scramble that deletes itself in a quarter of an hour.

## Changes

If what is kept changes, this page changes with it, and the date at the top moves. It is meant to be a description of the code, so if you ever find it disagreeing with what the site actually does, that is a bug and I would like to know.