What this site collects,
and where it goes.

There are two. The brief form sits on the homepage, /audit and /build. The step form is /start. Both send what you type to this site's own database first, then one alert email to me. The email and the row hold the same thing.

What the brief form takes: your name, your email, a URL, notes, and on /audit the tier you picked. What the step form takes: the URL, what the business does, the area it serves, the current marketing effort, a spend band, your name, your email, an optional phone number, notes, and up to six files of 4 MB each within thirty minutes of sending. Images are re-encoded on the server before they are stored, which strips the camera metadata block, including any GPS fix a phone left in the photo. PDFs are stored as sent.

Each submission also carries the session id and the first-touch record described in the next section, so a lead can be joined to the visit and the ad click that produced it. Two silent checks run on every submission: a hidden field that people never see (anything typed into it discards the submission) and a floor on how fast the form was completed.

The two Fail Closed forms on the provenance page take a name, an email, a company and a line about the surfaces involved; the install request lands in the same leads table and alert email as the brief form, and the library licence goes to card payment, described below.

• -Where it goes: the leads table in a Neon Postgres database I own, then an alert email delivered by Resend to the address at the foot of this page, with Reply-To set to you.
• -What is not collected: nothing you did not type. No IP address is written to the row.

The scan on /audit and in the first step of /start fetches the URL you paste and runs structural checks against it. The URL is used for that fetch and is not stored by the scan. Your IP address is counted in the memory of the running function for a limit of twenty-five runs in twenty-four hours; it is not written anywhere. The findings are shown to you and are not kept. If you then send the step form, the URL becomes part of your lead.

The site is served by Vercel. Like any host, Vercel sees every request, including your IP address and browser identifier, to serve it, and keeps its own platform logs under its own terms. Vercel Web Analytics and Speed Insights run on the site as cookie-less aggregates (page counts, referrers, Core Web Vitals) and read the same switch as everything else.

The fonts are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so Google receives that request as it would for any site using its font service. This does not depend on the switch.

Automated clients that identify themselves as such by user agent are answered with a slow error page rather than the site. One link in the footer is hidden from people and from screen readers and leads nowhere a person would go; a client that follows it is recorded as a bot event under a user-agent label and a hash of the user agent plus a coarse network prefix, held in the memory of that edge instance for twenty-four hours. The IP address is never written to the database. A signed, non-identifying cookie may be set on such a client so the mark survives across instances. Search engines and the AI crawlers listed in robots.txt are exempt.

The footer of every page carries a control that reads Analytics: on or Analytics: off. It is a real button, reachable by keyboard. The site measures a visitor who has not chosen; flipping the control to off stops the beacon, the platform analytics, and every tag for that browser, mid-visit, without a reload, and the choice is kept until you change it. A browser that sends Global Privacy Control is treated as off without touching the control. An explicit choice on the control outranks that signal either way. The forms are not measurement; they work with the switch off.