Privacy

I want to know which posts land, which tools people actually run, and where visitors come from, so I can spend time on what's useful instead of guessing. This isn't sold to anyone or used for advertising. It's a first-party pipeline I built and run myself on Cloudflare, the same infrastructure this whole site runs on.

• › The page path you visited, grouped with everyone else who visited the same page, not tied to any account or email.
• › Your country, resolved from Cloudflare's edge network rather than a precise location.
• › How you arrived: a coarse source label (direct, a specific social platform, search engine, AI assistant, newsletter, and so on) plus the referring site's origin only, never its path or query string.
• › A session identifier that lives only in this browser tab and resets when you close it.
• › Which numbered visit this is within that tab session, so I can tell a first page load from a fifth.
• › Roughly how long a page stayed visible to you.
• › Which landmark or goal you reached, from a fixed, published list, for example reading a quarter of an article or opening a case study.
• › Whether the request looked automated (a bot, scraper, or crawler) rather than a person.
• › Coarse device facts: a viewport width bucket, whether your input is touch or a mouse/trackpad, and your browser and OS family, each from a short fixed list, never a model, version, screen size, or fingerprint.

Just as deliberately, here's what never gets recorded:

• › No cookies for analytics.
• › No identifier that persists across visits or follows you between sessions.
• › No IP address retained past the request that carries it.
• › No free text: no search terms, tool inputs or outputs, error messages, or heading text ever becomes a stored field.

Everything above is written to Cloudflare D1, a first-party database under my own account. Nothing here goes through a third-party analytics vendor.

Estimated visible time measures whether a page stayed on screen, not whether anyone read it. Time in a background tab is excluded, but a visible page may still be unattended. A visit recorded as "direct" often just means the browser stripped the referrer or never sent one, not that you typed the URL by hand. Once that information is gone, I can't recover it. The automation classification is a heuristic built on request signals like headers and request rate, not a proven fact: it can call a person a bot, and it can miss a bot that behaves like a person.

Raw, row-level records are kept for 90 days, then deleted. After that, what remains is a set of identifier-free daily aggregates, kept for 13 months so I can compare rough trends year over year without holding onto anything tied to an individual visit.

The automation classification above only ever looks at browser traffic: requests that ran JavaScript and reported in through the same pipeline as everything else on this page. It's a heuristic built from request signals, not a proven fact, and it stays a heuristic on the public stats page too. Crawler requests, the search and AI bots that fetch a page without running any JavaScript, are a different kind of traffic entirely, and this pipeline doesn't collect them at all. The stats page says that plainly rather than leaving the topic out.

The control below turns analytics off in this browser. This site also already respects Global Privacy Control and Do Not Track: if either is set, analytics never starts here in the first place, and you don't need to do anything else. Once a visit has aged past the 90-day window, or as soon as it's folded into an aggregate, there's no identifier left on it, so there's no way for me to find and delete one specific visit after the fact. Opting out before a visit happens is the only way to keep it out entirely.

I'm not making a legal compliance claim on this page. This describes what the system actually does, plainly, so you can decide for yourself.