You can read this whole site without telling me anything.
Reading needs no account, no cookie banner and no consent dialog, because reading sets nothing that needs consenting to. Everything below is about what happens when you do something, and there is a short list of somethings.
I keep the least I can get away with, I never sell it, and every piece of it has a way out that you control rather than one that requires emailing me.
What I hold, and how to get rid of it
Nothing in this table exists until you do the thing in the second column.
A random token in a cookie
Created when: The first time you like anything
Why: So the same browser cannot like one thing twice
Getting rid of it: Clear your cookies and it is gone. It expires by itself after about 13 months
Your address, turned into something that is not your address
Created when: The same moment
Why: A second dedupe signal, so one person with two browsers is still one like
Getting rid of it: It is never stored as an address and cannot be turned back into one. Rotating the key forgets it entirely
Basic profile details from the sign-in provider you choose
Created when: You sign in
Why: To put a name on your comments and help review brand-new accounts
Getting rid of it: Delete your account and it goes with it
What you wrote, and when you edited it
Created when: You comment or send a story
Why: It is the thing you asked me to publish
Getting rid of it: Comments become a tombstone. Published stories stay published
Your email address, as your auth source supplied it
Created when: You sign in
Why: To send the story and direct reply notifications you control
Getting rid of it: Delete your account and it goes with it
Your Twitch user id
Created when: You link Twitch, which is optional
Why: To match you to stream history for badges, by id rather than by name
Getting rid of it: Unlink it, or delete your account
The like button, in detail
Likes need no account, which means the site has to recognise a browser somehow or the count is meaningless. It does two things. It puts a random identifier in a cookie, which knows nothing about you beyond being the same browser as last time. And it runs your address through a keyed hash and keeps only the result, which is 32 characters that cannot be turned back into an address and cannot be compared against anybody else's records.
I want to be straight about the second one rather than hide behind the word hashed: your address is briefly in memory on my server at the moment you press the button, the same as it is for every request to every website. What is different is that it is never written down. Change the key and the site forgets which browsers liked what, permanently, which is the property that makes it a dedupe token rather than a record of where readers live.
Who else your browser talks to
Fonts are served from this site, not from Google. There is no analytics script, no advertising network, no session recorder, and no tag manager. The site sets no cookie at all until you like something or sign in.
The exception, and it is a real one: video thumbnails are served by Google from
i.ytimg.com, so on any page showing a video your browser makes a
request to Google to fetch that image, and Google sees it. The player itself is
not loaded. A YouTube embed would pull roughly 870 KB of Google script onto the
page and start talking to them before you had asked for anything, so instead the
page shows a still and a play button, and clicking it takes you to YouTube,
where their rules apply and mine stop.
Signing in sends you to the auth provider you chose, and linking Twitch sends you to Twitch. Both see that you came from here. The pages are hosted by Netlify and the database is Supabase, both of whom process requests on my behalf and neither of whom get anything to use for themselves.
Deleting your account
It is a button on your account page, it works immediately, and it does not route through me. It removes your account, your handle, your badges, your address and any Twitch link.
Two things survive it, and you should know which before you press it. Comments become tombstones rather than vanishing, because deleting the middle of a conversation makes nonsense of the replies around it, and those replies belong to other people. Stories you have already had published stay published, because they are articles on a public site by then. If you want a published story taken down as well, email the privacy inbox and I will take it down.
This site can send three account notifications: when a dev disaster you sent is published, when it reaches the front page, and when somebody replies directly to one of your comments. All three start on. Each has its own switch on your account page, and every message has a link that turns off that type without asking you to sign in.
The delivery queue stores your account id and the details needed to write the message, but not your email address. The address is read from your auth account at send time and handed to Resend, the delivery provider. Delete the account and its queued messages are deleted with it. The site sends no welcome email, digest or marketing email from that account address.
The .NET Drip is the one exception and it is opt in. Its signup box sits on the front page and a handful of others, and it is the only thing here that asks you to type an address. If you use it, that address goes onto the Drip list, which is a newsletter I send from somewhere else. It is not joined to your account, signing in does not put you on it, having an account does not put you on it, and every issue carries its own unsubscribe link.
Where you live
If you are in the UK, the EU, or somewhere with similar law, you have rights to see what I hold, correct it, take it elsewhere and have it deleted. Most of that is a button here already. For anything a button does not cover, email the privacy inbox and I will do it by hand.
Children
This is a site about professional software. It is not aimed at children and accounts are not intended for anyone under 16.
When this changes
The date is in the sidebar and it only moves when something actually changed. If a change means I hold something new, that is not a quiet edit and I will say so before it starts.