07 Contact
What happens to what you send.
Short, because there is not much to describe. This site sets no cookies, stores nothing in your browser and loads no third-party script on any page. It counts page views and a few clicks, anonymously, on an analytics server I run myself, so most of what a privacy note usually covers does not happen here.
The site collects nothing about you.
Every page is a static file. There is no form that posts anywhere, no tracking pixel, no session, no account and no third-party embed. The audit page composes an email in your own mail client and sends nothing itself, which is why it asks you to consent to nothing: until you press send in your own client, none of what you typed has left your machine.
The analytics count visits, not visitors.
Each page sends a few events to analytics.sshlg.me, which runs Aptabase, an open-source analytics tool, on a server I operate in Frankfurt. An event says which page was opened, the domain of the site that linked to it, and which link, email address or copy button was used, named by the section it sits in. On the audit page it also records which kind of audit was picked, never what you typed.
No cookie is set and nothing is written to your browser. The server uses your IP address to look up a country, region and city and to count visitors with an anonymous hash that changes every day, so two visits on different days cannot be linked. It stores those, not the address, and its access logs drop client addresses. Events are deleted after two years. If your browser sends Global Privacy Control, the page sends nothing at all.
The host sees requests, as any host does.
The site is served by Cloudflare Pages. Serving a page means Cloudflare handles the request, and its logs contain the ordinary things a web request contains, including an IP address. That is Cloudflare's processing as the host, it is not read by me, and there is nothing on this site that joins it to a person.
Email is where data actually arrives.
Writing to contact@sshlg.me sends me your address and whatever you put in the letter. Mail for this domain is routed by Cloudflare Email Routing before it reaches me, which is visible in the zone's own records: the MX answers route1.mx.cloudflare.net and the SPF is v=spf1 include:_spf.mx.cloudflare.net ~all.
I read it, I answer it, and I keep it in the mailbox. I use it to reply to you and for nothing else: no list, no newsletter, no CRM, and it is never passed to anybody. The lawful basis is the obvious one, which is that you wrote to me.
An audit stays yours.
If you send a project for the free audit, what you send and what I find stay between us. If an audit turns up something other people should know, I will say that an audit found it and what kind of thing it was, never the finding, never your product, never your name. If you would rather I said nothing at all, write that in the email and that is the end of it.
Ask me to delete it.
Write to the same address and say so, and I delete the correspondence. You can also ask what I still hold, which will be the thread you already have a copy of. I am in Warsaw, Poland, so the GDPR applies and the rights it gives you are the ones described here, not a narrower version of them.