Privacy Policy

The short version

This is a personal site. There are no ads, no tracking pixels, and nothing about you is sold or shared with anyone. Visits are counted, but without cookies or anything that identifies you. The parts that do collect something are the parts you choose to use: the contact form, the comments and the assistant.

The site never sets a cookie for visitors, and there are no accounts to make.

Who is responsible

Michael Kinder runs this site from Haysi, Virginia, in the United States. For anyone reading this from the EU or the UK, that makes me the data controller. I do not publish an email address, so the contact form is the way to reach me about anything on this page, including a request about your own data.

What happens when you just read a page

Nothing that identifies you. There is no account, no profile, and no fingerprinting. The site runs on Vercel's servers, which keep logs that include IP addresses, as almost every web host does.

The site uses your device's own fonts, so nothing is fetched from a font service. Search runs in your browser, so what you type into the search box is never sent anywhere. Icons and images are served from this site, with three exceptions where your browser talks to someone else, which means they can see your IP address:

• Album artwork. The covers on the About page, in the now playing bar, and in the assistant's answers when it shows music are loaded from Last.fm's image servers, which run on Fastly. On the About page and the now playing bar this happens whether or not you interact with them.
• Cloudflare Turnstile. The anti-spam check on the contact form and the comment form under each post. It loads only on pages with one of those forms, and it looks at browser signals to decide whether you are a person.
• Tidemark. The analytics script, on every page. More on that just below.

Analytics

Visits are counted with Tidemark, a privacy-first analytics tool I built, which runs on Tidemark Cloud in the United States. It records which page was viewed, the site that sent you here, your country and region, your browser, operating system and type of device, a few events (following a link to another site, downloading a file, and sending a form), and how far down the page you scrolled and how long you were actively on it.

It sets no cookies and stores nothing in your browser. Your IP address is used for a moment to work out where you are, then thrown away, and the ID it uses to tell one visit from another changes every day, so it can't follow you from one day to the next or onto other sites. What it keeps are counts, not a profile of you. Tidemark's own privacy notice has the details.

Cookies and browser storage

The site does not set cookies for visitors. The only cookie it ever uses is my own sign-in to the site's admin area, and that is only ever set in my browser.

It does keep a few things in your browser's own storage, all first party, none used for advertising, and none of it following you anywhere else:

• fmd.commenter: Local storage, until you clear it. Only created once you use the comment form. A random ID for your browser, plus the name and email you typed, so the form is filled in for you next time. The ID is how the site shows you your own comment while it waits for approval, and how it knows your later comments can skip the wait. The server only keeps a scrambled (hashed) copy of it, never the ID itself.
• fmd.np.dismissed: Local storage, one hour. The moment you swiped away or closed the now playing bar, so it stays gone for an hour instead of coming straight back on the next page.
• fmd.np.seen: Session storage, until you close the tab. The last track the now playing bar opened up for, so it does not announce the same song again on every page you visit.
• fmd.ask.thread: Local storage, until you clear it. The last few messages of your conversation with the assistant, so it survives moving between pages. Clearing the conversation removes it.

Nothing here leaves your browser except the comment ID, which is sent along when you load or post comments, and the assistant conversation, which is sent when you ask it something.

The contact form

It asks for your name, email address, a subject and a message. When you send it, all four are emailed to my own inbox, which only I read, with your address set as the one to reply to. They are not stored on the site itself. They stay in my email until I delete them, which in practice means as long as the conversation is useful.

Two things guard the form. Cloudflare Turnstile checks that you are not a bot, and the form quietly measures how long the page was open and includes a field that humans never see, because scripts fill it in and people do not. There is also a limit on how many messages one address can send in ten minutes. To count them, the site keeps a scrambled (hashed) copy of your IP address for those ten minutes, then it expires.

Comments

Comments are stored in this site's own database, and there is nothing to sign up for. The form asks for:

• A name, which is shown with your comment. It does not have to be your real one.
• An email address, which is optional and never shown to anyone. If you leave one, it is used for exactly one thing: telling you when someone replies to your comment. Every one of those emails has a link that turns them off for that comment. Leave it blank and you will never hear from the site at all.

Your first comment waits until I approve it, and so does any comment with a lot of links in it. You can see your own waiting comment, nobody else can. Once one of yours is approved, your next ones from the same browser show up straight away. New comments also send me a short email with your name and what you wrote, but not your email address.

Comments are public once approved. If you want one changed or removed, use the contact form and tell me which.

The assistant reads approved comments too, because people sometimes say things in a thread that are not anywhere else on the site. That means a comment of yours can be quoted back to someone who asks a related question, along with the name you gave, and that its text goes to OpenRouter and Anthropic as reference material the same way a page does. Your email never does. The assistant is told to say who wrote what and never to pass a reader's words off as mine. Once a comment is deleted, the assistant stops seeing it straight away.

Posting is rate limited the same way as the contact form: a hashed copy of your IP address is kept for up to an hour to count how many comments one address sends, then it expires.

The assistant

When you ask the assistant something, your question, the last few messages in the conversation, and the path of the page you are on are sent to OpenRouter, which passes them to Anthropic's Claude to write the answer. The answer itself is drawn only from this site's own pages and the approved comments under the posts.

If you ask what a general term or tool means and the site doesn't explain it, the assistant may look it up on the web. Only a short search query about that term is sent, through OpenRouter to its search provider, Parallel, and never anything about you or about me: searches about me are refused outright. Answers like that are marked as coming from the web.

The site does not store your conversation on the server. It is kept in your browser, and clearing it in the panel removes it. Treat it like any other chat box and do not type anything sensitive into it. Questions are rate limited per address, the same hashed way, for a minute.

The short summaries at the top of each post are also written by Claude through OpenRouter, but only from the post's own text. Nothing about you is involved in those.

Buying me a coffee

The coffee button opens Cash App or PayPal in a new tab, whichever you pick, carrying the amount you picked too. No card or bank details ever touch this site, and nothing is sent to either service until you choose to go there. What happens after that is between you and whoever runs the one you used: Block for Cash App, PayPal for PayPal.

Who else is involved

These are the companies that handle something on this site's behalf. Each has its own privacy policy, and none of them are given your data for their own marketing.

• Vercel, United States. Hosting, server logs, and storage for the images in posts.
• Neon, United States. The database that holds comments and the short-lived records used for rate limits.
• hosting.com, United States. Email: sending and receiving contact messages, notes about new comments, and reply notifications.
• Cloudflare, United States. Turnstile anti-spam on the contact and comment forms.
• Tidemark, United States. Counting visits, as described under Analytics.
• OpenRouter and Anthropic, United States. The assistant's answers and the post summaries.
• Parallel, United States. Web searches for general terms the assistant looks up.
• Last.fm, United Kingdom, with images served via Fastly. Album artwork and my listening history.
• Block, United States. Cash App, if you use the coffee link and pick that one.
• PayPal, United States. The other coffee option, if you pick that one instead.

Most of these are in the United States, so if you are in the EEA, the UK or Switzerland, using those parts of the site means your data is transferred there. Those transfers rely on the providers' standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.

Why I am allowed to do this

If you are in the EEA or the UK, the legal bases are these. Replying to your message, showing your comment and emailing you about replies happen because you asked me to, which is your request and my legitimate interest in running a site people can talk to. Counting visits is a legitimate interest in knowing whether anyone reads the site, and it is done without cookies or anything that identifies you. Spam checks and rate limits are a legitimate interest in keeping the site working.

How long things are kept

• Contact messages: in my email until I delete them.
• Comments, with the name and email given: until you ask me to delete them or I do. That includes comments I turn down as spam, until I clear them out.
• Notes about new comments: in my email until I delete them.
• Server logs: however long Vercel keeps them.
• Visit counts in Tidemark: up to five years, depending on Tidemark's plan, and none of them identify you.
• Hashed IP addresses used for rate limiting: an hour at most, then they expire.
• Anything in your browser's storage: until you clear it.

Your rights

If you are in the EEA or the UK, you can ask for a copy of what I hold about you, ask me to correct it or delete it, object to or restrict what I do with it, and ask for it in a portable form. You can also complain to your national data protection authority.

If you are in California, you can ask what I have collected, ask me to delete or correct it, and opt out of the sale or sharing of personal information. There is nothing to opt out of: I do not sell or share personal information, I never have, and I do not use it for cross-context behavioral advertising. Asking me about any of this will never get you worse treatment.

Similar rights exist under other state and national laws, and I will honor them the same way regardless of where you are. Use the contact form and say what you want. For a comment, it helps to say which post it is on and the name you used. In practice the honest answer is often that I hold nothing about you beyond a message or a comment, because the site does not collect much to begin with.

Children

This site is not aimed at children, and I do not knowingly collect anything from anyone under 13, or under 16 in the EEA. If you think a child has sent me something or left a comment, tell me and I will delete it.

Changes

If this page changes, the date at the top changes with it.

Related: the Terms of Use cover what you can do with what is here.