What this site collects directly
Contact form: when you submit it, the details you provide (name, email, organization, and your message) are stored in our database (Supabase) so we can respond. We use them only to reply to and evaluate your inquiry — not for advertising, and we don’t sell them. You can ask us to access or delete your inquiry at any time using the email below.
Analytics: the site always uses privacy-friendly, cookieless analytics (Vercel Web Analytics) to count page views — no cookies, no personal identification. It also offers Google Analytics, which is off by default and loads only if you accept the cookie banner; if you do, it sets a single first-party analytics cookie. Advertising storage is never enabled, so there are no advertising profiles and no cross-site ad tracking. Until you accept, the site sets no cookies — and you can change your choice anytime via “Cookie preferences” in the footer.
Spam & abuse prevention: the contact form includes hidden anti-bot checks. To limit automated abuse, the server may briefly store a salted, one-way hash of your IP address — never the raw IP, and not reversible to it — and discards it automatically within hours.
Third-party services
Scheduling (Calendly): if you choose to book a call, a Calendly widget loads from Calendly’s servers and sets its own cookies. Any details you enter to book (name, email, meeting info) are submitted directly to Calendly and governed by Calendly’s privacy policy.
Newsletter (Substack): the “Work. Rewired.” section links to — and can embed — a Substack subscribe box. If you subscribe, your email is submitted directly to Substack and governed by Substack’s privacy policy; the subscribe embed loads only if you choose to open it. The site also reads Substack’s public RSS feed on the server to list recent posts — that request carries none of your data.
Bot protection (Cloudflare Turnstile): the contact form may load a Cloudflare Turnstile challenge to distinguish humans from bots. Cloudflare receives challenge signals (including your IP address) to issue a one-time verification token, and is designed to avoid cross-site tracking. Governed by Cloudflare’s privacy policy.
Hosting (Vercel): the site is served by Vercel, which processes standard request data (such as IP address and user agent) in server logs to deliver and secure the site, per Vercel’s privacy policy.
Analytics (Vercel Web Analytics): aggregated, cookieless page-view metrics. It does not set tracking cookies or store data that identifies you, and is designed to be GDPR/CCPA-compliant; data is processed by Vercel. This runs always.
Analytics (Google Analytics via Google Tag Manager): only if you accept the cookie banner, the site loads Google Tag Manager and Google Analytics 4 to measure page views and on-site activity, setting one first-party analytics cookie. We use Google Consent Mode v2: advertising storage is denied at all times — no ad cookies, no Google Signals, no remarketing. Before you accept (and if you decline), Google receives only cookieless, aggregated signals. You can withdraw consent anytime via “Cookie preferences” in the footer. Data is processed by Google under Google’s privacy policy.
Database (Supabase): contact-form inquiries are stored in a Supabase Postgres database (US region) that we control. Access is locked down so the website can only write new inquiries, not read existing ones.
Email: if you email directly, that message is handled by your email provider and ours.
Your rights
Depending on where you live (for example under GDPR in the EU/EEA or CCPA/CPRA in California), you may have rights to access, correct, delete, or export your personal data, and to object to certain processing. To exercise them — including deleting a contact-form inquiry you submitted — email us at the address below and we’ll action it directly.