Privacy notice
This is a personal site. I run it myself, in my own time, at my own expense. Nothing on it is for sale. This notice explains the small amount of personal data the site handles, and what I do with it.
Who is responsible
I am, Jon Cosson. I run joncosson.com personally and non-commercially, which makes me the data controller for anything you send me through it. You can reach me through the contact form.
What the site collects
The only place the site asks you for anything is the contact form. It takes three things: your name, your email address and your message. You choose what to put in them.
When a message is submitted, the site also stores a one-way hash of the network address the message came from. That hash cannot be turned back into your address. It exists purely to stop the same source flooding the form, by counting recent submissions. Nothing else about your visit is recorded.
The form has a hidden field that people never see. Automated spam tends to fill it in. When it is filled in, the message is discarded and nothing is stored.
Why, and on what basis
I use your name, email address and message for one purpose: to read what you wrote and to reply if a reply is wanted. The lawful basis is legitimate interests, in that you have contacted me and expect an answer. The rate limiting hash rests on the same basis, keeping the form usable and free of abuse.
Where it is stored, and who else is involved
Messages are stored in a hosted database provided by Lovable Cloud, which runs on Supabase infrastructure. They act as processors on my instructions.
The site itself is served through Cloudflare, which sits in front of the hosting and passes requests along. In doing that it sees ordinary technical information such as your network address, in the same way any web server does.
The typefaces used here, Fraunces and Karla, are loaded from Google Fonts. Your browser therefore makes a request to Google when a page loads, and Google sees your network address as part of that request. No cookie is set by it. If you would rather that request did not happen, the fonts can be served from this domain instead, and I am happy to make that change.
No email is currently sent out by the site. Messages sit in the database and I read them there. If that changes and a mail provider is added, this notice will be updated to name it.
How long it is kept
I keep messages while there is a reason to, which usually means until the conversation has run its course, and I clear out old ones periodically. Anything with no continuing purpose is deleted within twelve months. Rate limiting hashes go with the message they belong to.
What I never do with it
Your details are never sold. They are never passed to anyone for marketing, never added to a mailing list, and never used for advertising or profiling. There is no advertising on this site and there is no tracking. See the cookies page for the detail of that.
Your rights
Under UK GDPR you have the right to ask for a copy of the personal data I hold about you, to have it corrected if it is wrong, to have it erased, to have its use restricted, to object to my using it, and to receive it in a portable form. Where I rely on legitimate interests, you can object and I will stop unless there is a compelling reason not to.
To use any of those rights, contact me through the contact form. Tell me what you are asking for and enough detail to find your message. I answer within one month, and usually much sooner. There is no charge.
If you are unhappy
Please tell me first, because most things are quickly put right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.
Changes
If the site starts handling data differently, this page changes with it. It describes what actually happens today, not what a site of this kind might do.