Privacy Policy

I am Jack Greenacre, a software engineer based in Norfolk, UK. This is my personal website. For anything you send me through it, I am the data controller - meaning I am the person responsible for it, and the person to ask about it.

You can reach me at [email protected]. If you would like a postal address for a formal request, ask and I will give you one.

Very little, and there is no account to create. In full:

• What you type into the contact form - your name, your email address and your message. Nothing is required beyond those three, and there are no hidden fields collecting anything else.
• Technical data in my server logs - your IP address, the page requested, the time, and what your browser reports about itself. Every web server records this, and it is what lets me spot faults and abuse.
• Cookieless analytics - aggregate counts of page views, described in the Cookie Policy. Nothing in it identifies you.

The contact form is also protected by two checks that look at how the form was submitted rather than at who you are: a field hidden from people, and how quickly the form came back. Neither collects anything, and neither is kept.

Under the UK GDPR I have to have a lawful basis for using your information. For everything on this site it is legitimate interests - mine in running the site and replying to people who contact me, balanced against your privacy.

• To reply to you. If you send me a message, I use your name and email address to answer it, and to carry on the conversation afterwards.
• To keep the site working and secure. Server logs are used to investigate errors and to deal with abusive traffic.
• To understand roughly how the site is used. Aggregate page counts tell me which pages are worth keeping.

I do not use any of it for marketing. Your email address is not added to a mailing list, is never sold or shared, and you will not receive anything from me that you did not ask for.

Almost nobody, because there is almost nobody involved. This site is not hosted with a hosting company - it runs on a machine I own and administer myself. There is no cloud provider between you and it, so the server logs described above sit on my own hardware rather than someone else’s. The same is true of the analytics, which runs on my own machine rather than being handed to an analytics company.

That leaves exactly one supplier acting on my instructions as a processor:

• My email provider, which carries the message from the contact form to my inbox and the acknowledgement back to you. It is the only third party that sees anything you send me.

I do not sell your information, and I do not share it for advertising. The only other circumstance in which I would hand anything over is if I were legally required to.

This site has no database. A message sent through the contact form is not stored here at all - it is emailed to me and exists only as email.

• Contact messages stay in my mailbox for as long as the conversation is useful, and are deleted once it plainly is not. You are welcome to ask me to delete yours sooner.
• Server logs are rotated automatically and are kept for a matter of days, not years.
• Analytics holds only aggregate counts, which were never personal information and are kept indefinitely as statistics.

The whole site is served over HTTPS, so what you type into the contact form is encrypted in transit. Mail is handed to my email provider over an authenticated, encrypted SMTP connection. Credentials are held as environment variables on the machine rather than written into the code.

Because the server is my own, it is under my physical control rather than in a shared datacentre - I keep it patched and I am the only person with access to it. The flip side of running your own hardware is that there is no provider on call at three in the morning, so the honest position is this: the site is small, it holds almost nothing, and the little it does touch passes straight through to my inbox. No system is perfect, but there is deliberately very little here to lose.

Under the UK GDPR you can ask me to:

• give you a copy of what I hold about you;
• correct it, if it is wrong;
• delete it;
• restrict what I do with it, or object to my using it at all;
• hand it to you, or to someone else, in a portable format.

Ask at [email protected]. It is my own inbox, so it comes straight to me. I will respond within one month, and there is no charge. In practice, for most people the honest answer will be that all I hold is an email thread.

If you think I have handled your information badly, please tell me first - it is a small site and I would rather put it right. If that does not resolve it, you have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint.

If what I do changes, this page changes with it, and the date at the top is the authority on when it was last revised. There is no mailing list to notify, so the date is how you tell.