Privacy Policy

This policy explains what information this website and my services collect, how it is handled and who else may process it. Privacy is the basis of the business, and this site is built to demonstrate that.

This website uses zero outside trackers, zero analytics and zero advertising networks. There is no Google Analytics, Facebook Pixel or any other service collecting data on visitors. No tracking cookies are set and no consent banner is needed. Your browsing activity on this site is never recorded, shared or sold.

The only personal information this website collects is what you provide through the secure contact form. That means your name, email address, message and, if you choose to give them, a phone number and how you heard about us. The same sealed payload carries a little context, such as your browser language and time zone, the page you first landed on, the site that sent you here and any campaign tags on the link you clicked. That context is held in your browser tab only until you send the form, is never sent on its own and sets no cookie. That information is encrypted in your browser before it is sent. The message is sealed with a single use AES-256-GCM key, and that key is wrapped with a 4096 bit RSA public key whose private half never leaves one trusted workstation.

This client side encryption sits on top of the standard TLS encryption used for all web traffic. The encrypted data is stored at rest on infrastructure I control and is never exposed to an outside cloud provider. Decryption happens only on that single workstation. Once a message is read and answered it is deleted from the database.

For clients whose systems I look after, monitoring collects operational data from the systems I look after, such as uptime checks, resource usage, log entries, certificate and patch status and security findings. This data is used only to keep those systems running and secure. It is stored on systems I control, retained for the length of the engagement plus a short period for reporting and then deleted. Client data inside the monitored applications (for example customer records in your store) is not copied into the monitoring platform.

I use AI tools to draft code, tests, documentation and reports. Routine monitoring and alerting run on systems I control with no outside AI involved. When investigating an incident or preparing a report, excerpts of logs or configuration may be sent to a cloud AI provider. Secrets, credentials and personal data are removed first. The current provider is Anthropic. An option that runs only locally, with no cloud AI provider, is available on request for any client.

You have the right to request a copy of the information I hold about you and to request its deletion. Use the contact form to make such a request.