Privacy
What this site collects, why, and what you can ask me to do about it.
The short version
This site has no accounts, no sign-up and no contact form, and it sets no cookies. It measures how people use it, and nothing here is used to identify you or sold to anyone.
The analytics tool does keep two identifiers in your browser so it can tell one visit apart from another. They are described under Analytics below, and you can clear them at any time from your browser settings.
Booking a conversation happens on a separate scheduling service, and that is the only point at which you give me your details.
Who is responsible
James Hobbs is the controller for personal data collected through this site, based in London, United Kingdom. To ask anything about this notice, or to exercise any of the rights below, message me on LinkedIn or raise it when we speak.
Hosting
The site is hosted by Vercel. Their servers keep request logs, which include your IP address, your browser’s user agent and the page you asked for. Those logs exist to serve the site and protect it from abuse.
Analytics
I use Dash0 to understand how the site is used and whether it is working. The script is served from this domain rather than a third-party CDN, and the events it sends go to an endpoint inside the EU. It records:
- Page views, page load timing and browser errors.
- The site or app you arrived from, taken from the referring hostname and any utm_source in the address, and grouped as direct, search, social, referral, campaign or AI assistant.
- Links you follow: the address, the first 50 characters of the link text, where on the page it sits, and whether it was a booking or a services link.
- How far down a page you scroll, at the 25, 50, 75 and 100 percent marks.
- Which sections of a page come into view, and which questions you expand.
- Whether your browser is set to a light or dark colour scheme.
- When a reflection on the scorecard is completed, and the verdict it produced.
Dash0 handles your IP address in order to receive those events. I do not use any of this to identify you, and I do not combine it with anything else.
The Dash0 script keeps two values in your browser so that the events from a single visit can be grouped together: d0_tab in session storage, which your browser discards when you close the tab, and d0_session in local storage, which persists between visits until you clear it. They are random identifiers. They hold nothing about you, and I cannot use them to work out who you are, but they do let the analytics recognise a returning browser. No cookies are set, and my own code stores nothing at all.
Analytics do not run on local or preview builds, or for automated browsers. Clearing site data in your browser removes both identifiers, and browsing in a private window keeps them for that window only.
The reflection tool
Your scorecard answers stay in your browser. They are held in the part of the address after the #, which browsers never send to a server, and the analytics script redacts that part of the address before any event leaves the page. Opening a shared scorecard link switches analytics off for that page load entirely.
One event is recorded when you finish: that a reflection was completed, and the verdict it produced. The verdict is one of a small number of summary categories. Your individual answers are not recorded.
Other services
- Vercel — hosting and request logs.
- Dash0 — analytics, with an endpoint in the EU.
- Motion — used to book a conversation. Once you follow that link you are on their service, and their privacy notice applies.
- LinkedIn and GitHub — outbound links only. Nothing is shared with them unless you click.
Why this is lawful, and how long it is kept
Request logs and analytics are processed on the basis of legitimate interests: running a working site and understanding whether it is useful, balanced against how little is collected and the fact that none of it identifies you.
Analytics events are kept for as long as the Dash0 workspace retains them, and hosting logs for as long as Vercel keeps them for operational purposes. Neither is kept in order to build a profile of you.
Your rights
Under UK data protection law you can ask what data I hold about you, ask for it to be corrected or deleted, ask me to restrict how it is used, or object to it being used at all. In practice there is very little to find, because nothing here identifies you.
Message me on LinkedIn and I will respond within one month. If you are not satisfied, you can complain to the Information Commissioner’s Office.