Privacy
Version 2026-09.3 · updated 2026-09-10
This site is a personal experiment with an intelligence layer. What it keeps about you stays in your browser and is never sent to a server. Separately, it counts how the site itself is used — and publishes every one of those counts at /analytics. What you see there is all it gets.
What is kept, and what it is for
| rung | what you give | where it lives | what it buys | off |
|---|---|---|---|---|
| passing through | nothing that outlives this tab — a session cookie and this tab's own state | this browser tab only | the guide, without memory of earlier visits | nothing to turn off |
| remembered here | what you open, ♥, what you tell the guide in your words, and — if you choose to save them — your name and email | this browser (never a server) | picks that improve across visits; the guide can quote what you told it | /opt out |
| counted, not identified | a tally that names nobody — which page was fetched, from which country, by a person or an agent | a public table at /analytics | a shared picture of how the site is used, for you as much as for me | nothing to turn off — there is nothing individual to remove |
Your controls
| the right | the command | what it does |
|---|---|---|
| know what is held about you | /profile | the profile page — everything this browser holds, editable in place, with a download of it all as one file |
| erase it | /opt out | wipes this browser's record, the visitor id, and the contact-verification cookie |
| correct it | /profile | edit or remove any field or answer on the profile page |
| see where you stand | /opt | your standing and the switch — opt in to be remembered here, opt out to clear it; the full statement is this page |
| see everything the site records | /analytics | the whole counted record, published — there is no other view, mine included |
Who
This is the personal site of Ammon Haggerty. Reach me through /contact — a form, or just ask the guide — and I reply by email.
What this is, and isn’t
The old site ran Google Analytics. This one runs no third-party analytics: no advertising or marketing identifiers, no device fingerprinting, nothing sold or shared. It does count its own traffic — and publishes the entire count at /analytics. That page is not a summary of a private database; it is the database. I hold no view of it that you do not.
The counts describe the site, not you. Each is a separate total with no key joining it to any other, so there is no way — for me or anyone — to reassemble one person’s visit from them. Page counts, country counts and command counts sit in different tables that cannot be joined, because the link between them is never written down.
To estimate how many distinct visitors the last day brought, your IP address and browser type are mixed with a random key and folded into a statistical sketch that holds no identifiers. Each key lives 48 hours and is then destroyed, which is why this site can tell you roughly how many people came in the last 24 hours and can never tell you whether one of them came last week too.
Three yes/no facts about your browser join that same short-lived sketch, so the site can tell people from scripts without identifying anyone: whether it ran this page’s script, whether it stayed on the page long enough to be read and registered one real click or keypress (never which), and whether it reports itself as automated. A fetch of a hidden link no person can see, or of a page that does not exist, is noted the same way.
Never counted: anything you type. Not your searches, not your messages to the guide, not your answers to its questions, not the addresses of pages that did not exist. Only values from fixed lists — a page name, a country code, a command name.
What the site keeps about you is smaller and more personal — the tables above — and it keeps nothing past your tab unless you choose the remembered here rung.
The guide is an AI. Each message you send it, together with the current page and — if you are on the remembered here rung or have answered its questions this session — the record described above, is sent to the model provider (Anthropic) to generate the reply, then discarded by me. I do not store conversations on a server. The site is hosted on Cloudflare (US); Anthropic is in the US; if you are in the EU your data therefore leaves the EU for the length of a request.
Three things outside the tables
- Contact verification. If you ask the guide for something private (a phone number) it may ask
whether I know you, and check a name plus a few digits against a one-way hash of my contacts. A
successful check sets a separate cookie (
ah_grant, 30 days) so it needn’t ask again./opt outasks the server to expire it too; if that request fails,/opt outsays so, and the cookie expires on its own within 30 days. - Contact relay. A message you send through /contact — the form or the guide — goes to Ammon by
email through Resend (US) with the name and email you give; a Cloudflare Turnstile check runs first
to keep out bots. The site does not store the message. Nothing is kept unless you choose to save
your name and email, which then live in your browser like everything else on the remembered-here
rung (
/opt outclears them; export all data in/profile). - This session’s mechanics. A session cookie identifies your tab to the site; the tab’s own state (what you opened, the chat you can see) lives in the tab and dies with it. The chat is rate-limited per IP address — a count against your address, kept for at most an hour, never the content.
Retention
- Browser rungs: until you
/opt out, or until you clear this site’s data in your browser. A record from before this notice existed, never kept or cleared, is removed after 90 days. - Counted totals: detailed daily counts for 90 days; the headline series indefinitely, published monthly in the site’s public repository. They name nobody, so there is nothing in them to expire.
- There is no account rung yet. When one exists it will get its own row here, its own consent, and a stated retention period before it stores anything.
If something goes wrong
The record is in your browser, so a leak of my systems cannot expose it. If a future account rung changes that, this section will say what would be exposed, who I would tell, and how fast.
Signals I honor
- Global Privacy Control: with GPC on, you are never asked to be remembered (you can still opt in
from
/opt). - Nothing here is directed at children.