Privacy.

This is my archive, and you are a guest in it. What follows is the whole of what I collect, what I refuse to collect, and how to tell me to stop.

The short version

• If you are in Europe or the UK, no analytics load until you say they may. Nothing is placed on your device and nothing is read from it before then — not a script, not a request.
• Everywhere else, analytics start by default, and you can turn them off whenever you like from Privacy choices at the foot of any page.
• If your browser sends Global Privacy Control, I stop. Everywhere, without being asked, and even if you had previously said yes.
• One thing is not covered by that choice, and I would rather say so plainly than bury it: I keep a plain headcount of how many people came. It puts nothing on your device, tells no one else, and cannot be traced back to you or matched to yesterday. It is described in full below.
• I do not sell your information and I do not share it with advertisers. There is no advertising on this site and no ad network is given anything.

Who is responsible

This site is built and run for me by Starchive.io, Inc — they are the data controller, the ones legally answerable for everything described here. When I say I on this page, that is who is doing the keeping.

Attn: Legal Department – Privacy, 88 Grace Glen, Nellysford, VA 22958. For anything on this page, including any request below, write to privacy@starchive.io — that address reaches the people who can actually act on it.

What I collect

If you only look around

The cookies in the table below, and — only with your permission — a record of which pages and which photographs were looked at, for how long, and which doors were pressed. That record carries a random identifier for your browser, never your name, unless you are signed in.

If you join

Accounts are run by Clerk. They hold your email address, your name, and your sign-in credentials; I never see a password. On my own side I keep your display name, the handle other members see, a short biography and an avatar if you write one, your membership tier, and the dates you joined and last changed something. If someone invited you, I keep who that was.

What you do here

Comments you write, songs you play and how far into them you got, favourites, notes you leave in the scrapbook, and how far through the archive journey you have walked. These are the site working, and they are kept for as long as your account exists.

The headcount

Separately from all of the above, I count how many people come. It happens on my own server as the page is built, so nothing is placed on your device and nothing is read from it, and your browser is never told it happened. Two numbers come out of it: how many pages were loaded, and how many different people loaded them.

The second number needs some way to tell one person from another, and this is exactly how it is done. Each day I generate a random secret. Your network address and your browser's user-agent are scrambled together with that day's secret into a short string that cannot be turned back into either. Your address is never written down anywhere — not in a record, not in a log. The string is counted once and thrown away, and the day's secret is destroyed within 48 hours, which means that even I cannot work out afterwards who any of them were. Tomorrow's secret is unrelated to today's, so the same person is an entirely different string tomorrow: there is no way to ask this who came back, and there is nothing here that could ever become a profile.

This one runs whatever you have chosen, including if your browser sends Global Privacy Control, and I want to be straight about why. Every other kind of counting on this site can be switched off precisely because it identifies something. This one is a tally of strangers — it is not linked to your account even when you are signed in, no one outside this site is told about it, nothing is sold or shared, and within two days there is nothing left that could be pointed at a person. Without it I would have no idea how many people the archive actually reaches, because everyone who declines the rest is invisible to it — which is as it should be, and is also why this one has to be counted differently.

What I deliberately do not collect

This is the part I would want to read first. When I count what has been looked at — the record described above, the one your choice governs — I do not record and have never recorded: your IP address, your browser's user-agent string, the page URL or path, the site you came from, your screen or window size, your language, your time zone, how far you scrolled, or where your cursor went. Each of those is one line of code away and each would turn a count of what was looked at into a record of a person. The only thing derived from your request is whether you are on a phone, a tablet or a desktop.

The headcount is the one exception and it is described above rather than quietly excluded here: it passes your address and user-agent through a one-way scramble and keeps neither. Nothing else on this site touches them.

For a short window — minutes — a request's network address may be held to stop one visitor from overwhelming the site. It is not kept, not indexed against you, and expires on its own.

Cookies

Name	What it does	Kept for	Basis
site-access	Remembers that you got past the password curtain, while one is up.	Until the password is changed	Necessary
cs-consent	Remembers your answer to the question about counting — yes or no. Setting it is the only way not to ask you again.	6 months	Necessary
cs-mid	Ties the links that serve photographs and recordings to your browser, so a link copied out of the page stops working. Cannot be read by any script.	30 days	Necessary (security)
cs-ref	Remembers whose invitation you arrived through, so the right person is credited if you join. Cannot be read by any script.	30 days	Necessary to honour an invitation
Clerk session cookies	Signs you in and keeps you signed in. Set by Clerk, who run accounts for this site.	Session and refresh windows set by Clerk	Necessary
cs-fid	The identifier my own counting is joined on, so a visit and a return visit are one person rather than two. Cannot be read by any script.	1 year	Only with your permission
_ga, _ga_PEHQBRY23C	Google Analytics. Set by Google, and only after you have said yes.	Up to 2 years	Only with your permission

Counting, and your choice about it

Two things count what you do here. One is mine, and its rows live in my own database. The other is Google Analytics. Both are governed by the single choice you make — there is no arrangement where you turn Google off and I keep counting.

The headcount described above is the third, and it is the one your choice does not govern. It records nothing about what you did, keeps nothing that could be pointed at you, and is gone within two days.

Google Analytics is configured with every advertising feature switched off: no Google Signals, no ad personalisation, no advertising identifiers, and ad data redaction on. That is what keeps it measurement rather than something to be sold from.

In the European Economic Area, the United Kingdom and Switzerland, nothing analytical loads until you accept. Google's script is not fetched, so no request reaches Google and your address is never handed over. Elsewhere, counting starts by default and stops the moment you say so.

If you came here from one of my emails, the link may carry a small tag that tells me which subscriber visited — but only if you have allowed the counting above. Say no, and the tag is thrown away at the door: I learn that an email brought somebody, and nothing about who.

To change your mind at any time, use Privacy choices at the foot of any page. Withdrawing is one click, exactly like giving.

Who else sees any of this

• Clerk — accounts and sign-in.
• Google Analytics — only with your permission.
• Vercel — hosting. Serves every page and, like any web server, processes the network address of the request.
• MongoDB Atlas — the database everything above is stored in.
• Brevo — my mailing list. Holds subscribers' email addresses and what happened to the emails I send — delivered, clicked, unsubscribed — and, for members, a summary of how they use the site, so I know who I am writing to. Unsubscribing there is honoured here: an address that has said no is never written back onto a list.
• Squarespace — the shop's catalogue, if a shop is open. Purchases happen on their side, under their policy.

The archive itself — the photographs, films and recordings — is held on the platform Starchive.io, Inc runs. That is not a disclosure to anyone else; it is the same organisation named above, which is why it is not in the list.

These are service providers acting on my instructions; none of them is given anything to use for their own purposes. All but Brevo are United States companies, so information about you may be processed there; Brevo is a French company. Where the law requires safeguards for that, they rest on the mechanisms those providers publish — standard contractual clauses, and the EU–US Data Privacy Framework where the provider participates.

I may also disclose information if the law compels it, or to establish or defend a legal claim. Nothing here is used to make an automated decision about you.

How long I keep it

• What was looked at: 400 days, then deleted automatically. Records of things you deliberately opened or pressed are kept, because they are acts rather than a consequence of scrolling.
• Counts and totals: kept. They are aggregates and do not identify you.
• The headcount's scrambled strings, and the daily secret they were made with: 48 hours, then deleted automatically. Only the two numbers survive.
• Your account and what you wrote: until you delete it.
• Rate-limiting records: minutes.
• The raw log of email events — what my email service reports about a send, as it reported it: 30 days, then deleted automatically. What survives is the summary — that an address bounced or unsubscribed — not the log itself.

When an account is deleted, its analytics are taken out of every public and aggregate figure immediately. The underlying rows are marked rather than destroyed, and remain visible to me and my staff as an audit and security record. If you want them genuinely destroyed rather than marked, say so in your request and I will do that instead — it is a separate and irreversible step, it reaches everything including my mailing-list record of you at Brevo, and I will confirm when it is done.

Marks on photographs

The archive is unpublished work, and it is protected. Images served to signed-in members may carry a faint mark identifying who they were served to, so that a picture found somewhere it should not be can be traced back. If that is switched on you will see it; the record joining a mark to a person is kept as a security record for as long as the material is protected.

Your rights

If you are in Europe or the UK: you may ask for a copy of what I hold, ask me to correct it or delete it, ask me to restrict or stop a particular use, ask for it in a portable form, and withdraw consent at any time without affecting what was done before you did. You may also complain to your national data protection authority, or to the ICO in the UK. Counting rests on your consent; running your account rests on our agreement; protecting the archive rests on my legitimate interest in defending unpublished work, and you may object to that.

If you are in California: you may ask what has been collected about you and why, ask for it to be deleted or corrected, and ask me to stop selling or sharing it. There is nothing to stop — I do not sell personal information and do not share it for cross-context behavioural advertising, and have not in the past twelve months. I honour Global Privacy Control as an opt-out signal. I will never treat you differently for exercising any of this. The categories in the statute's own words: identifiers, internet or network activity, and commercial information, collected for the purposes described above.

Anyone, anywhere, may ask me for any of this and I will do it.

How to ask

Write to privacy@starchive.io from the address on your account, or tell me enough to find you. I will answer within a month, and sooner if I can. If a request is extraordinarily large I may take longer and will tell you why.

Children

This site is not directed to children, and I do not knowingly collect anything from anyone under 16. If you believe a child has given me something, write to me and I will remove it.

Changes

If this changes in a way that affects you, I will say so here and update the date at the top. If a change needs your consent, I will ask again rather than assume.