Privacy
Reading this site leaves nothing behind. Writing to us leaves one email in one mailbox, and this page says exactly what is in it.
v1.0Last reviewed . A rebuild is not a review, so this date is written down rather than taken from the clock.
The short version
There is no analytics on this site, no tag manager, no advertising pixel, no A/B test and no session recorder. No cookie is set and no local storage is written. Nothing here builds a profile of you, because there is nothing here that could.
That is not a promise about intentions; it is a description of what the site is. Every page is a file rendered before you arrived, and the whole of the JavaScript it ships is a handful of small scripts that make blocks on the page work. None of them reports anything anywhere.
One page has a form on it. If you use it, a message reaches a person. Everything below is about that message and about the requests a browser makes for pictures and maps.
What is actually held
Named as the specific things they are, rather than grouped into categories like "technical data", which is the phrase a policy reaches for when it would rather not say.
- Nothing, if you only read
- No cookie is set, no local storage is written and no analytics script exists, so reading this site leaves nothing behind in your browser and nothing in any account anywhere. There is no profile here to be part of.
- What you type into the contact form
- Your name, your email address and your message, because a reply needs all three. They are turned into one plain-text email, sent to the address below, and answered by a person. Nothing writes them to a database, because there is no database.
- Roughly where the message came from
- That email carries a short block Cloudflare works out at the edge from the connecting address: town, postcode, country, the local time where you are, the network and the data centre that took the request. Nothing is asked of you and no third party is consulted. It is a hint rather than a fact — mobile data, a VPN or an office network can put you a country away from what it says — and nothing here decides anything from it.
- The submission, in the log
- The endpoint records how each submission ended, in its own words, and that line currently includes the posted message. It is written to Cloudflare's log for the site and is not copied anywhere else. This is a deliberate choice rather than an oversight, it is one line in the source to switch off, and it is stated here because a log is somewhere.
- A count, briefly
- The form accepts three posts a minute from one address. The counter lives in memory at the edge for the length of that minute and is never written down.
- Ordinary server logs
- Cloudflare keeps the access records any web server keeps, for its own operation and for the site's. They are used to keep the site up and for nothing else.
Who else your browser talks to
Six hosts, and four of the six only under a condition you control. The pictures are the unconditional one: photographs here are remote URLs that Unsplash's CDN crops and re-encodes, because resizing images is deliberately not something this build does.
| Host | What it is for | When | What it learns |
|---|---|---|---|
| x3m.us | The site itself, served by Cloudflare, plus the one address the contact form posts to. | Every visit. | Your address, the page you asked for, your browser's user agent, and the time. |
| images.unsplash.com | Every photograph here, cropped and re-encoded by Unsplash's image CDN rather than by this build. | As any page carrying a photograph loads. | Your address, your user agent, and which picture was requested. |
| i.ytimg.com | The still frame standing in for an embedded video before anybody presses play. | As the one page carrying a video embed loads. | Your address, and which video the still belongs to. |
| www.youtube-nocookie.com | The video player, built into the page by a script only once you have asked for it. | Only after you press play, and never otherwise. | What any YouTube page sees, including whatever it stores in your browser. |
| unpkg.com | Leaflet, the library that draws the maps, pinned to one version and checked against a hash. | Only when a map block comes near the viewport. | Your address, and which two files were fetched. |
| tile.openstreetmap.org | The map's picture tiles, which are what a map is made of. | Only once a map has begun drawing. | Your address, and which part of the world you are looking at. |
Worth knowing: A video here is a still picture and a play mark until you click it. The player only exists afterwards, and it is loaded from youtube-nocookie.com. A map is a written list of addresses and coordinates first; the map is drawn over the top of that, and neither the library nor a single tile is fetched until the block is nearly on your screen.
Why any of it is lawful
A message you send is answered because you sent it, which the General Data Protection Regulation calls a legitimate interest and most people call replying. Nothing is processed on the basis of consent, because nothing here asks you for any — and a site with no cookies to consent to has no business showing you a banner.
The rough location line in a submission and the rate limit in front of the form exist to keep the form usable by people rather than by scripts. Both are described in full on this page rather than buried, because a reader cannot object to something they were not told about.
How long it is kept
Correspondence is kept for as long as it takes to answer it and to have a record of what was agreed. Log entries live on the host's own retention schedule and are not archived elsewhere. The rate-limit counter lives for a minute in the memory of one data centre and is never written down.
Nothing here is backed up to a second system, sold, shared with a partner, or used to train anything.
What you can ask for
- Ask what is held
- Write to hello@x3m.us and the answer will be the messages you have sent, if any, and nothing else. There is no account to export.
- Have it corrected
- If something in a message you sent is wrong, say so in a reply and the correction is kept with it.
- Have it deleted
- Ask, and the correspondence is deleted from the mailbox. Log entries age out on the host's own schedule and cannot be picked through by hand.
- Object, or withdraw
- There is nothing to opt out of, because nothing is running. The only processing that happens is answering a message you chose to send.
- Complain to a regulator
- A reader in the European Union may complain to their national data protection authority; a reader in Serbia to the Commissioner for Information of Public Importance and Personal Data Protection. Neither needs permission to be told first.
All of it goes to hello@x3m.us, which is the one address this site publishes and the same one the form's mail arrives at. There is no privacy team; there is a person.
Children
This site is not directed at children and holds nothing that would identify one. If a child has written through the form and you would like that message removed, ask and it will be.
Changes to this page
This page carries a version and a review date, both written by hand, because a rebuild is not a review. Since the site is generated from version control, every revision of this text is recorded in that history — there is no earlier version of this policy that quietly stopped being true.
The cookie policy covers storage in your browser, and the terms cover everything else about using the site.