What we collect,
and what we do not.

1The short version

This site uses analytics, which means it records anonymous page views. The forge, our free starter-repository tool, asks for an email address to confirm you are human and to send you a receipt. There is no account, no password, and no newsletter.

We do not sell data, we do not run advertising, and we do not build advertising profiles. The email address you give the forge is used to confirm the request and to send the archive. You can ask us to delete it at any time, and the contact details are at the bottom of this page.

2Analytics

When you load a page, analytics records the visit. We use two tools for this, both of which report in aggregate and neither of which is used to identify you personally.

Cloudflare Web Analytics runs at the edge through our host, Cloudflare. It reports page views, referrers, and rough geography without using cookies and without tracking you across other sites.

Google Analytics 4 runs through Cloudflare Zaraz, our tag manager. It records page views, session information, and interactions such as scrolling or outbound clicks. Google Analytics uses cookies and may set identifiers to distinguish repeat visits. We do not enable Google signals, advertising features, or data sharing for advertising, so the data stays in the analytics property and is not used to target ads.

Whether you are asked first depends on where you are. Visitors in the United States are not asked, since the site sells no data and runs no ads, and US privacy law gives you the choice to opt out rather than asking up front. For everyone else, the first visit shows a consent banner, and nothing is sent to Google until you accept. The banner lets you accept all, reject all, or choose per tool. Cloudflare Web Analytics is cookieless, so it runs either way. Your choice is stored in a cookie of its own so the banner does not ask again.

You can change your mind at any time. The Cookie settings button in the footer reopens the banner everywhere, including the United States, so a US visitor can turn analytics off even though no banner asked them first.

Analytics data is processed by Cloudflare and by Google under their own privacy policies. It is retained according to the settings on those services. We read it in aggregate to understand which pages help people and which do not.

3The forge

The forge is the one place on this site that asks you for something. To stamp a starter repository, you enter an email address and we send a one-time code to confirm a human is behind the request. That keeps the tool free and stops bots from draining it.

When you use the forge, we store:

• Your email address, so we can send the code, the receipt, and the archive. This is kept as our own list of the humans who have used the tool, and it is never sold or shared.
• A hashed form of your email address and a hashed form of your IP address, used to enforce a fair daily limit and to detect abuse. The hashes are keyed with a server secret, so reading the database alone does not reveal the underlying values.
• A hashed form of each one-time code. The raw code exists only in the email sent to you, never in the database.
• The details of what you asked the forge to stamp: the brand name, tagline, description, chosen pages, and a record of the archive that was generated. This is the ledger of record for what the tool produced and when.

The forge sends only two kinds of mail: the one-time code you asked for, and, if you stamp something, the receipt with your archive. There is no marketing mail, no newsletter, and no campaign list.

Codes and expired rows are pruned on a rolling basis. One-time codes are kept for about a week for audit, and the daily funnel events are kept for about ninety days. Your email address and the stamp ledger are kept as the record that a human used the tool, and are removed on request.

4What we do not collect

There is no account system, so there is no password and no profile. We do not ask for a name, an address, or payment details anywhere on this site. There is no contact form that silently stores what you type; the contact page gives you an email address and a phone number instead.

We do not sell, rent, or trade personal data. We do not share it with advertisers. We do not use it to build a profile of you across other websites.

5Cookies and local storage

Google Analytics sets cookies in your browser to tell repeat visits from new ones. It runs for US visitors by default; everywhere else it runs only after you accept it. Your choice is stored in a cookie of its own, so the banner does not ask on every visit. Cloudflare may also set a short-lived security cookie as part of protecting the site from bots and abuse, under its own privacy policy. The site sets no advertising or profiling cookies of its own.

Your theme choice, light or dark, is stored in your browser's local storage so the site remembers it. That value never leaves your device and is not sent to us.

The forge sets an HttpOnly session cookie while you are completing the human check. It is scoped to the forge API, is not readable by scripts on the page, and expires after thirty days. It is a signed token, not a record in a database, and it carries no personal data beyond a reference to your check.

You can change your mind at any time. Clearing this site's cookies forgets your choice: outside the United States the banner asks again, and in the United States analytics returns to its default, which you can turn off again from Cookie settings. You can also block cookies in your browser, and the site still works; the only effect is that analytics cannot distinguish a repeat visit and the forge cannot remember your check.

6Third parties

A few services process data on our behalf, each under its own privacy policy:

• Cloudflare hosts the site, serves it from its network, and provides Web Analytics. Cloudflare may process standard request metadata such as IP address and user agent to serve and protect the site. See the Cloudflare Privacy Policy.
• Google processes analytics data through Google Analytics 4, and only after you allow it. See the Google Privacy Policy.
• Resend delivers the forge's email, the one-time code and the receipt. It sees the email address the message is sent to, as any mail provider would. See the Resend privacy policy.

We choose these providers for what they do, not to pass data along. None of them receive data from us for advertising.

7How long we keep data

Analytics data is retained according to the settings on Cloudflare and Google. Forge one-time codes are kept for about a week, and daily funnel events for about ninety days. Forge email addresses and the stamp ledger are kept until you ask us to remove them.

If you would like your email address and the records tied to it deleted, contact us and we will do it.

8Your rights

You can ask us what data we hold about you, ask for a copy, or ask us to delete it. If you are in a region with specific data protection rights, such as the European Economic Area, the United Kingdom, or California, you have the rights those laws provide, and we will honor a reasonable request regardless of where you live.

Because the site collects so little, most requests come down to the forge email address. Contact us using the details at the bottom of this page and we will respond.

9Children

This site and the forge are built for businesses and developers, not for children. We do not knowingly collect personal information from children under thirteen. If you believe a child has given us an email address, contact us and we will remove it.

10Changes to this policy

When the site changes in a way that affects this policy, we update this page and the date at the top. Material changes will be described in plain terms rather than buried. Because the site keeps no account list, there is no mailing list to notify; the date at the top is the signal.

11Contact

Questions about privacy, or a request to delete your data, can go to the email address or phone number below. We are a small shop and a human reads them.