Privacy / what happens to what you send

Plainly, and all of it.

I read every message myself. What you send is stored in my own database and nowhere else, and no third party has any of it. The site sets no cookies as you browse it, and it has no analytics service and no ad pixels. One small random id sits in your browser so I can tell a return visit from a first. What follows is the long version.

When you write to me

The contact form takes your name, your email, your company or site if you give one, what you need, a budget range if you pick one, and what you write. A call request also takes a phone number and the day and part of the day you asked for. Your device's timezone comes along silently, so that "morning" can be read in your time and not mine; nobody is asked for it.

All of it goes into my database and into my inbox. I use it to reply to you, and to do the work if we go ahead. I may also write to you later about work I think would fit: an offer, or a pitch for something I could build you. That is me writing to you, not a mailing list, and one line back telling me to stop is the end of it. I do not sell your details and I do not pass them to anyone else. Each message is stored with where it arrived from: the page you landed on, the site that sent you, and the country and region Cloudflare reports. It also carries that id, so I can see which pages you read before writing.

What the site records on its own

Every page records that it was opened: the address of the page without anything after the question mark, the site you came from, your country and region, whether you are on a phone or a desktop, which sections you reached, which controls you touched, and how fast the page felt on your own device.

It is recorded against a number, not a name. That number is a one-way hash of the day, your address and your browser. It changes at midnight, it cannot be turned back into you, and no cookie is set to keep it. The back office is excluded from all of it. Nothing here is shared with anyone, because there is nobody to share it with: this site makes no third-party requests at all, and the fonts are served from this domain.

One exception, and only if I sent you a private page with a password. When you type that password, or open the page from the link in my message, one cookie remembers it on your device for thirty days, so you are not asked again. It holds nothing about you, it is read by that page and nothing else, and it is never set for anyone who was not sent a password.

That number changes at midnight, so it cannot tell a return visit from a first one. For that the site keeps a small random id in your browser: twelve characters, nothing about you in them, never shared. It is not a cookie. It is replaced after 180 days, clearing this site's data removes it, and your browser can refuse it: Global Privacy Control or Do Not Track means none is made.

The one exception is on the contact page. If the anti-spam check is switched on, that page loads Cloudflare Turnstile, which is a request to Cloudflare and to nobody else. When it is off, nothing loads.

The calculators

The maths runs in your browser while the page's script is running, and nothing you type is sent anywhere. The link you copy carries the fields of the form, which is how somebody else can open the same result. With JavaScript turned off the pages still work, and then the fields do travel to my server in the address, the same way a copied link does. Either way, what you typed is never written to the record described above: that keeps the address of the page and not what is after the question mark.

The checkout speed test

This one reaches out, and its own page says so. It sends the address you give it to your store and to nowhere else, with a user agent that names the page. It keeps the host and the path it read, the numbers, the names of the plugins and the outside hosts, what the checkout said back, and the verdict. That row answers for a day, so that the next person asking about the same store does not make your server work again, and it stays in the log after that. It also keeps a one-way hash of your address, to hold the ten-reads-a-day limit. It never keeps the page itself.

How long, and how to ask

I keep messages and the page record indefinitely, because a conversation from two years ago is often the one that matters. I would rather say that than quote a number I do not keep to. If you want to know what I hold about you, or want it gone, write to hello@norvahl.com and I will do it.

Where it lives

Cloudflare, in their Workers and D1 products. Nobody else has access, and there is no other copy.

Last changed 8 September 2026 · the browser id