xptio
A small site. Clear boundaries.
What this site stores, for how long, and what it never stores. This page covers every part of the site: the home page, the blog, the CV and the admin area.
No tracking, no visitor cookies
The site sets no cookies for visitors and includes no third-party analytics or advertising trackers. It does not store visitors’ network (IP) addresses.
Browser preferences
Your colour theme is kept in this browser’s local storage, not in a cookie. On the blog, the article layout, page size and saved reading list are kept there too. They are not an account and are not shared across devices. Clear this site’s browser data to remove them.
Comments
Comments ask for a display name and text, not an email address. Names are supplied by visitors and are not verified. Comments are stored privately for review; approved names, text and timestamps become public on the relevant article. Avoid posting personal or confidential information.
Questions, constructive corrections and different viewpoints are welcome. Spam, harassment and private information may be removed. To request a correction or removal, write to the site owner (contact details below) with the article link and enough detail to identify your comment.
Article views
Opening an article or its reading preview increases an aggregate counter. Only totals are saved to disk; no visitor identifier or viewing history is stored. These approximate counts are not unique-reader statistics.
Abuse prevention
Comment submissions and repeated article opens are limited with a hash of the network address and a random salt that exists only while the server runs. The hashes stay in server memory (ten minutes for comments, one minute for article opens) and are never written to disk or stored with a comment. Hosting infrastructure may keep its own request logs.
Administrators
Only signed-in administrators receive cookies: a secure session cookie, and a xptio_signed_in hint that only lets pages show signed-in controls and carries no secret. Administrator actions, including sign-in attempts, are written to an audit log with the time, the account and the network address the action came from, for security review.
Feeds and sponsorships
RSS and JSON feeds require no registration. Sponsorship links, when enabled, are labelled. External sites and feed readers have their own privacy practices.