Privacy

Minimal analytics

This site uses Cloudflare Web Analytics for aggregate page-load and performance measurements. It can report things like the page path, referring site, country, browser, operating system, and device type. It does not use advertising cookies or build a profile that follows you across websites.

Cloudflare also processes the network information needed to serve and protect the site. I can see aggregate traffic, not a named history of what one person read.

The only page-open numbers I keep are anonymous totals for The Book (landing page and each chapter). Counts only — never who, never a cookie for tracking, never a profile. They're for me to see whether anyone is reading the chapters at all.

Stories and comments

No account, no email, nothing required.

I don't ask who you are and I don't try to work it out. If you include a descriptor with your piece, like a role or how long you've been at it, that stays attached to the writing rather than to a person.

Screening

Submissions and comments are screened for identifying details before anything appears. Names, companies, email addresses, phone numbers, and anything that points at one particular workplace.

There is an automated pass, and then a person reads it before it runs.

For that automated pass, the text of a submission or comment is sent to Anthropic for safety screening. No account, email address, or raw network address is included with that request. The check approves or rejects the text; it does not rewrite it.

I want to be accurate about what that gets you. It catches the obvious things reliably and it catches most of the rest. It is not a guarantee. If something identifying makes it through, tell me and it comes down the same day.

That's a real limit and I'd rather state it than promise you something I can't hold.

The newsletter

If you subscribe, your address is held by the email provider for delivery only.

No subscriber list is displayed anywhere, including to me. I see totals. I don't browse names.

Your address is stored by Resend while you are subscribed. When you unsubscribe, it is marked as suppressed rather than erased, and the only thing that record is ever used for is making sure you are not mailed again — it is not an active subscription, it is not used for any other purpose, and deleting it outright would mean a later import could quietly put you back on the list. Resend may also retain limited operational records under its own legal and security obligations. There's an unsubscribe link on every email, and you can ask me to erase the suppression record entirely.

If you start a signup and never confirm it, your address is held on the site's own database while that is still in progress. You get one reminder after three days, and nothing after that. If you never confirm, the address is deleted after thirty days. You are not on the list in the meantime and you are not mailed anything else.

Abuse prevention

A one way hash of your network address may be stored with a submission. Never the raw address, never on the public site.

It does two jobs. It rate limits spam. And when you tap the heart on a comment, it is what remembers that the heart is yours — so the count doesn't double when you reload, and tapping again takes it back. That is the whole reason the hash sits next to a love: without it every heart would be anonymous to the point of being uncountable.

Because the heart you see is worked out from your own hash, those responses are never cached or shared — what one reader sees is never served to another.

The hash is one way. It can't be turned back into your address, and it isn't published, isn't sold, and isn't used to work out who you are. It is not an account and it does not follow you between devices or networks — on a different connection, your hearts will look like someone else's.

What doesn't happen here

No data is sold. No advertising profiles are built. No operator names, personal emails, or social profiles appear on this site. Nobody attempts to re-identify anonymous writers.