What this site keeps, and why.

The short version

• Browsing these pages sends nothing about you anywhere, apart from the ordinary server logs every website has.
• A visit counter runs only with your say-so in most of the world, and until you opt out in the United States. It never runs if your browser sends a Global Privacy Control or Do Not Track signal.
• Writing through a form sends exactly what you typed to one inbox, and nothing else is done with it.
• No adverts, no advertising cookies, and nothing is sold or shared with anyone.

Who is asking

ShepherdUX is a one-person design and build studio run by Ali. It is the controller of anything this page describes. For any question about your data, write to hello@shepherdux.com; that address reaches the same person who reads the inbox and holds the keys.

What is collected, and when

When you browse

The host, Hostinger, keeps standard server logs: the address of your connection, the page asked for, the time, and the name of your browser. Every web server does this. The logs keep the site running and show when someone is abusing it, and they are used for nothing else. They are kept for the short period the host keeps such logs.

Your browser also holds two small things for the site's own working: which light you chose, day or night, and the last few words you typed into the search box. Both live in your browser only and are never sent anywhere.

When you allow analytics

With your answer, PostHog counts visits: which pages and cards are read, how far along a world people travel, where they arrived from and where they left, the kind of device and browser, and the country the connection appears to come from. Each browser is given a random identifier so that a return visit counts as the same visitor. It is not tied to a name, an email address or an account, there is no tracking across other sites, and nothing is used to show you anything. PostHog reads the address of your connection to place it on a map and to guard against abuse. The count tells the studio which parts of the site are worth the work.

When you write

The two forms, the brief and the quick note, send what you typed: your name, an address to reply to, the message, and the page you wrote from. The server also records the address of the connection and a hashed signature of the browser, which exist to stop one machine flooding the inbox (five notes an hour) and are never used to identify you. Everything lands in the studio's own inbox and a copy is emailed to the owner. You are not added to any list, there is no newsletter, and the address is used to answer you and for nothing else.

Cookies and browser storage

Everything this site or PostHog writes into your browser, by name. The first three are needed for the site to work and are exempt from consent; the rest exist only after you allow analytics, and are removed the moment you decline.

Your answer, and changing it

Cookie settings

The notice you saw depends on where your device says it is. In the European Union, the United Kingdom, Switzerland and most of the world, nothing runs until you say yes. In the United States the count runs from the first page and the notice tells you so, with the way out beside it. The site reads your device's clock zone to tell the two apart, and when it cannot tell, it asks. A Global Privacy Control or Do Not Track signal from your browser is honoured everywhere: the count stays off and no notice is shown.

Your answer is kept in this browser for six months and then asked for again. Withdrawing it is one click, here or at the mark in the corner of any world: the count stops at once and PostHog's cookie and storage are cleared from this browser. What already reached PostHog stays in the count unless you ask for it to be deleted, which you can do by email.

Where it goes

• PostHog Inc., the analytics, on their United States cloud. They process the count on the studio's instructions and under their privacy policy, which states their certification under the EU-US Data Privacy Framework and its UK and Swiss extensions, with standard contractual clauses behind it.
• Hostinger, the host: the server, its logs, and the mailbox that carries a copy of anything you write.
• Nobody else. Nothing is sold, nothing is shared for advertising, and nothing goes to a data broker.

How long

• Server logs: for the short period the host keeps them.
• The visit count: for as long as the studio's PostHog plan keeps events, and any one visitor's part of it is deleted on request.
• Messages you send: in the inbox while the conversation is live, archived after, and deleted on request.

Your rights

If you are in the United Kingdom, the European Union or the wider European Economic Area, Switzerland, or anywhere with similar law, you can ask to see what is held about you, have it corrected or deleted, have its use restricted, take a copy of it, object to it, and withdraw your consent at any time without affecting anything done before. The lawful bases are your consent for the count, legitimate interest for the logs and the spam limit, and the steps before a contract for answering a brief. You can also complain to your data protection authority; in the UK that is the Information Commissioner's Office.

If you are in California or another US state with a privacy law: this site does not sell or share personal information, and it never has. You can opt out of the count with the button above or with a Global Privacy Control signal, ask what is held about you and have it deleted, and you will not be treated any differently for asking.

Wherever you are, write to hello@shepherdux.com and expect an answer within a month, usually much sooner.

Children

This site is not aimed at anyone under sixteen, and nothing on it asks for an age.

Changes

This page is edited in place when anything above changes, and the date at the top moves with it. A change that alters what is asked of you also brings the question back on your next visit.