privacy policy @ stwoo.net Last updated: 16 August 2026 The short version This site collects nothing that identifies you. It is a static site with one addition: cookieless, self-hosted visit counting (see Analytics below), which never sees your IP stored or your activity followed across sites. No accounts, no comments, no advertising, no cross-site tracking. The only way this site ever receives personal data about you specifically is if you deliberately type it into the contact form and press send. Who runs this site stwoo.net is a personal site published by Vedad K. It is not a company and it sells nothing. Questions about this policy, or about any data you have sent, go through the contact page. What the site does not do Stated plainly, because the absence is the point: No comments. The site has no comment system and will not be getting one. There is nothing to moderate, no commenter identities, no Gravatar lookups, no spam queue. No accounts. There is no registration, no login, no user profiles, no password resets. No advertising and no third-party tracking. Nothing on this site is sold, and no data about you is sold, rented, or shared for marketing. No cookies. The site sets no cookies at all — not for consent, not for sessions, not for preferences. There is no cookie banner because there is nothing to consent to. The contact form The contact form asks for three things, all of them optional in the sense that you can simply not write to me: Name — so I know who I am replying to. A nickname is fine. Email address — used solely as a reply-to address. Message — whatever you choose to write. Please do not put sensitive personal information in it; there is no reason to, and this is an ordinary mailbox. That is the complete list. The form asks for nothing else and infers nothing else. Your submission is used for one purpose only — to read your message and answer it. The site has no newsletter or mailing list, so nothing you send is ever added to one. The form also contains one hidden field that is invisible to people and only ever filled in by automated bots. If it arrives filled in, the submission is discarded without being delivered. It captures nothing about you. Where a contact message goes When you press send, the form posts to a small script on this site's own server, which does two things and then forgets about it: Sends the message to my personal mailbox as an ordinary email. Posts a copy as a notification into a private Slack workspace that only I have access to, so I notice it. Slack is operated by Slack Technologies (Salesforce), which means a copy of your message and the details you typed is processed on their infrastructure, which may be located outside your country. Your message is not written to any database or file on the web server. There is no submissions table, no stored archive, no export. Once the message has been delivered to the mailbox and to Slack, the server holds no copy of it. Nobody other than me reads these messages. They are not shared with anyone else, and there is no third party involved beyond the mail and Slack delivery described above. Spam protection The contact form is protected by a proof-of-work challenge — currently ALTCHA, self-hosted on this site's own server. It exists for exactly one reason, to stop automated spam submissions, and runs only on the contact form. It plays no part in reading posts or browsing pages. Being self-hosted is what matters here, whatever the specific mechanism: your browser solves a short mathematical puzzle and the answer is checked by this site's own server, with no verification call to any outside service. That means your IP address is never sent to a third-party captcha provider, no cookie is set, no identifier is assigned, and you are not fingerprinted or tracked across sites. The exact mechanism may change in the future — this page will be updated if it does — but self-hosted, no third-party sharing, and no tracking are the properties any replacement has to keep. The widget script is served from this site's own server rather than a public CDN, so using the form does not cause your browser to contact any third party at all. Analytics This site counts visits using Plausible, self-hosted on a server I run — not the Plausible.io cloud service, not Google Analytics, not Matomo-as-a-service. The script that does this loads from central.stwoo.net, a server I also operate. It is a different subdomain from this site, so your browser does make a request to it, but it never reaches a third-party company — the data stays on infrastructure I run, and nothing is sold or shared onward. Plausible is built to be cookieless: it sets no cookie and assigns you no persistent ID. To count you as one visitor rather than several across a day without storing anything that identifies you, it computes a hash from your IP address, your user-agent, and a site-specific value that rotates daily, then discards the inputs — your IP address is used for a moment to produce that number and is not written to a database or log by Plausible. The hash itself cannot be reversed back into your IP, and it changes every day, so the same visitor cannot be linked across two different days from it. What this produces is aggregate counts — page views, referrers, rough country/device breakdowns — never a profile of any individual visitor, and never anything shared with or sold to anyone else. There is no cross-site tracking: this analytics setup only knows about visits to this site, not anywhere else you go. Dark mode is stored in your browser, not on the server If you use the light/dark toggle, your choice is saved in your browser's own local storage under the key dark-mode. This is not a cookie: it is never attached to requests, never transmitted, and never seen by the server or by anyone else. It stays on your device, and clearing your browser data removes it. Server logs Like effectively every web server, the hosting provider may keep standard access logs — IP address, timestamp, requested URL, user-agent — generated automatically for security and troubleshooting. These are a function of the hosting, not something this site collects, builds on, or analyzes. They are not used to profile visitors, are not combined with anything else, and are not linked to contact form submissions. Embedded content and outbound links Posts on this site may link to other websites. Following a link means the destination site receives your request and applies its own privacy policy — this one only covers stwoo.net. Images shown on this site are served from this site's own server. Where third-party media is ever embedded in a post (a video player, for example), that provider can see your request and may set its own cookies, exactly as if you had visited their site directly. How long anything is kept Contact messages live in my mailbox and Slack history for as long as the conversation is useful, in the same way that any ordinary email correspondence does. There is no automated retention system to describe, because there is no system holding the data — just an inbox. If you would like a message and its details deleted, ask and they will be. Your rights over your data Because the only data held is whatever you typed into the contact form, exercising your rights is straightforward. You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Write to the address you were replying to, or use the contact form, and it will be handled without argument. There is no data to export in bulk, no profile to download, and no advertising identifier to opt out of, because none of those things exist here. Changes to this policy If the site ever gains something new that touches your data — a newsletter, embedded third-party content, a change to how analytics works — this page will be updated before that goes live, and the date at the top will change. The intention is to keep the answer to "what does this site collect?" at "nothing, unless you write to me."