Privacy / what happens to what you send

Plainly, and all of it.

I read every message myself. What you send is stored in my own database and nowhere else, and no third party has any of it. There are no cookies on this site, no analytics service and no ad pixels. What follows is the long version.

When you write to me

The contact form takes your name, your email, your company or site if you give one, what you need, a budget range if you pick one, and what you write. A call request also takes a phone number and the day and part of the day you asked for. Your device's timezone comes along silently, so that "morning" can be read in your time and not mine; nobody is asked for it.

All of it goes into my database and into my inbox. I use it to reply to you, and to do the work if we go ahead. I may also write to you later about work I think would fit: an offer, or a pitch for something I could build you. That is me writing to you, not a mailing list, and one line back telling me to stop is the end of it. I do not sell your details and I do not pass them to anyone else. Each message is stored with where it arrived from: the page you landed on, the site that sent you, and the country and region Cloudflare reports.

What the site records on its own

Every page records that it was opened: the address of the page without anything after the question mark, the site you came from, your country and region, whether you are on a phone or a desktop, which sections you reached, which controls you touched, and how fast the page felt on your own device.

It is recorded against a number, not a name. That number is a one-way hash of the day, your address and your browser. It changes at midnight, it cannot be turned back into you, and no cookie is set to keep it. The back office is excluded from all of it. Nothing here is shared with anyone, because there is nobody to share it with: this site makes no third-party requests at all, and the fonts are served from this domain.

The one exception is on the contact page. If the anti-spam check is switched on, that page loads Cloudflare Turnstile, which is a request to Cloudflare and to nobody else. When it is off, nothing loads.

The calculators

The maths runs in your browser while the page's script is running, and nothing you type is sent anywhere. The link you copy carries the fields of the form, which is how somebody else can open the same result. With JavaScript turned off the pages still work, and then the fields do travel to my server in the address, the same way a copied link does. Either way, what you typed is never written to the record described above: that keeps the address of the page and not what is after the question mark.

The checkout speed test

This one reaches out, and its own page says so. It sends the address you give it to your store and to nowhere else, with a user agent that names the page. It keeps the host and the path it read, the numbers, the names of the plugins and the outside hosts, what the checkout said back, and the verdict. That row answers for a day, so that the next person asking about the same store does not make your server work again, and it stays in the log after that. It also keeps a one-way hash of your address, to hold the ten-reads-a-day limit. It never keeps the page itself.

How long, and how to ask

I keep messages and the page record indefinitely, because a conversation from two years ago is often the one that matters. I would rather say that than quote a number I do not keep to. If you want to know what I hold about you, or want it gone, write to hello@norvahl.com and I will do it.

Where it lives

Cloudflare, in their Workers and D1 products. Nobody else has access, and there is no other copy.

Last changed 8 September 2026