Privacy Policy

This website sets no cookies. It runs no analytics, no tracking, no advertising pixels and no session recording. There is no account to create.

There is one place on this site where you can type: the scoping questionnaire at /brief/. It has three short text fields. What you write there is assembled in your own browser and is never sent to us — we do not receive it, it is not stored anywhere, and it is gone the moment you close or reload the page. Whether any of it reaches us at all is your choice: you copy it, or you email it.

We do not know who you are unless you choose to tell us, which you only do if you email us or pay a deposit for work.

If you email us or message us on Telegram: your email address or Telegram handle, and whatever you write. We keep it because we cannot answer you or run your project without it. Lawful basis: performance of a contract (Art. 6(1)(b)) where you are a client, and legitimate interests (Art. 6(1)(f)) where you are not.

If you pay a deposit through this site: your name, email address and billing address reach Stripe, our payment processor, on Stripe's own servers. Card numbers never reach us and never touch this website — payment details are entered directly on a Stripe-hosted page. Lawful basis: performance of a contract (Art. 6(1)(b)) and legal obligation to keep accounting records (Art. 6(1)(c)).

Server request logs: our host, Vercel, records the IP address, user agent, requested URL and timestamp of each request, for security and to diagnose faults. These are not merged with anything else and are not used to build a profile of you. Lawful basis: legitimate interests (Art. 6(1)(f)).

No cookies, local storage beacons or similar tracking identifiers. No analytics. No advertising or cross-site tracking. No third-party embeds that would set their own cookies — fonts are served from this domain rather than from a font CDN, specifically so that visiting this site does not tell anyone else that you did.

If we ever add a tool that changes this, this page changes first. We would rather tell you than have you discover it.

We do not run error monitoring on this site. There is no monitoring SDK loaded, no endpoint configured, and no session recording. An earlier version of this policy described error monitoring as present but switched off; it has since been removed from the project entirely, because a switched-off thing still ships in the bundle and only takes one withSentryConfig() call to switch on.

If we ever add error monitoring, this policy is updated before it goes live, and it will say exactly what is captured.

Vercel — our hosting provider. Processes server request logs in the United States.

Stripe — our payment processor. Processes payment and billing details in the United States and Ireland. Stripe is certified to PCI DSS Level 1; because card details are entered on Stripe's own page and never reach our servers, this project stays within the lowest PCI compliance category and never stores, transmits or logs a card number.

GitHub — our source host. Any personal data that appears in a commit, issue or pull request is visible to the repository's collaborators.

If you become a client, we hold the working notes for your project — what is built, what is outstanding, and the dates — so that you can see progress at a private link. Those notes deliberately carry no name, company or email address of yours. If we ever did hold such details, you would be told here.

Nobody else. We do not sell, rent or trade personal data, and we have never done so.

Enquiries that do not become projects: deleted within 12 months.

Client correspondence and project records: kept for 7 years, because tax and accounting rules in several jurisdictions require business records to be retained that long.

Server logs: our host rotates them within 30 days.

If you are in the EU, UK, Switzerland or the Gulf, you can ask us to show you the personal data we hold about you, correct it, delete it, restrict how we use it, or object to our using it at all. You can also ask for it in a portable format.

If you are in California, you have the right to know what personal data is collected, to request deletion, to correct it, and to opt out of its sale or sharing. We do not sell or share personal data, so there is nothing to opt out of — but the right exists and we will honour it.

We respond within 30 days and there is no charge for making a request. Email us and we will deal with it.

We are a US company and our processors are largely US companies, so your data leaves the region you are in. Where that transfer is subject to the GDPR we rely on Standard Contractual Clauses approved by the European Commission, together with a transfer impact assessment.

Traffic is encrypted in transit with TLS. The site sets a strict Content Security Policy and standard browser security headers. We collect no credentials because we ask for none.

No system is perfectly secure. If a breach affecting your data occurs, we will notify you and the relevant supervisory authority within the 72 hours the GDPR requires.

This site is a business service and is not directed at children. We do not knowingly collect data from anyone under 16.

If this policy changes in a way that affects you, the date at the top changes and the substance here changes with it. We do not revise history silently.