Privacy
What this site records, what it doesn't and why. Short version: no cookies, no IP addresses, nothing that follows you around.
When you visit
The page you opened, its title, the time and the city and country your connection appears to come from are recorded and shown publicly on the Activity page. The city comes from our host's IP lookup and coordinates are rounded to about 10 km. Only the latest 300 events are kept and daily visit counts expire after 40 days.
Your IP address is never stored. To avoid counting the same visit twice, the site makes an anonymous key by hashing your IP and browser with a secret that changes every day. It can't be reversed and can't link your visits across days.
While a tab is open and visible, it checks in every 45 seconds for up to 15 minutes. That's how the footer knows how many people are here now. A check-in is forgotten after 70 seconds.
If your browser sends Global Privacy Control or Do Not Track, none of this happens: the site doesn't record your visit or check in at all.
Appreciation
The Appreciate button on posts stores a count, plus your anonymous key so each reader can give a post up to ten a day. The Activity page shows the city it came from.
Letters
If you join the letters list, your email address is stored with Kit, the email service that sends the letters. Kit emails you a link to confirm first and nothing is sent until you click it. Your address is used only for the letters, is never shared or sold and every letter has a one-click unsubscribe link. The Activity feed notes that someone signed up, with the same city-level detail as a visit, never the address itself.
Weather and GitHub
Bombay's weather is fetched by the site's server from Open-Meteo (data licensed CC BY 4.0), so your browser never contacts them. The Activity page also lists public activity from my GitHub profile.
In your browser
Your theme choice and whether you've turned off keyboard shortcuts are saved in your browser's local storage. They never leave your device.
Elsewhere
If analytics are switched on, pages load Google Analytics to count visits in aggregate. That's covered by Google's privacy policy. Links to YouTube, GitHub, LinkedIn and other sites take you somewhere with its own policy.
Questions go to reach-hs@duck.com and I'll answer them directly.