Privacy

This site is built the way I would ask a client to build one, so this page can be specific rather than general. Every statement below describes the server configuration that is actually deployed.

Effective 2026-09-05. This page is rewritten whenever the site is rebuilt, and the date above changes with it.

Who is responsible

British Columbia’s Personal Information Protection Act requires an organization to designate one or more individuals responsible for its compliance, and to make that person’s position and contact information available to the public (s. 4(3) and s. 4(5)). That is the purpose of this section.

Position: Principal, SecHB.
How to reach that person: the contact form, which goes to a monitored mailbox. Say in the first line that it is a privacy request, so it is not read as a sales enquiry.

The Act asks for a position and a route, not a personal name or a postal address. Both are given above. If you would rather not use a web form for a privacy request, say so in it and a direct address will be sent back to you.

What the website records

The web server writes one line per request, containing exactly these fields:

Your IP address with the final part removed — the last octet for IPv4, everything after the first three groups for IPv6. What is stored identifies a network, not a visitor. Anything that does not match either pattern is logged as 0.0.0.0 instead.
The date and time of the request.
The page or file requested, and the HTTP method and version.
The response status code and the number of bytes sent.
The referring page, if your browser sent one. Links leaving this site send no referrer, because the site sets Referrer-Policy: no-referrer.

Your browser’s user-agent string is deliberately not logged. Server error logging is set to report only critical faults, because nginx cannot be told to shorten IP addresses in that log.

Retention: access logs are rotated daily and deleted after 14 days. Nothing is archived beyond that, and no copy is kept elsewhere. The rotation is configured on the server to match this sentence — if the two ever disagree, the server is what is true, and this page is the defect.

Cookies, and why there is no banner

This site sets no cookies, uses no local storage, loads no analytics, no advertising or social pixels, and no third-party scripts. There are no web fonts or images fetched from another domain, so loading a page here contacts nobody but this server. There is no JavaScript on the site at all, including on the contact form, which is enforced by a Content-Security-Policy of default-src 'none'. The form is plain HTML and works with scripting switched off.

Consent to store or read information on your device is what triggers a cookie banner. Nothing here stores or reads anything, so there is nothing to consent to and no banner is shown. A consent dialog on a site like this one would be decoration, and it would be the first thing I would question on a client’s.

Do Not Track

There is no tracking to switch off, so a Do Not Track or Global Privacy Control signal changes nothing about how this site behaves — it is already the behaviour those signals ask for. No other party collects information about your activity on this site, because no other party is contacted.

Where this is hosted

The server is in the United States. If you are reading this from Canada, the United Kingdom or the European Union, the request data described above is processed in the United States, and US authorities can compel disclosure of data held there under US law. That is a real consideration and it is stated here rather than buried.

If you use the contact form

The form on the contact page collects your name, your email address, and your message; organisation, document type and deadline are optional and blank unless you fill them in. There is one hidden field that must stay empty — it catches automated submissions, and a human never sees or completes it.

What happens to a submission, precisely:

It is posted to this site’s own server. No third-party form service is involved, so nobody but me receives it.
The server turns it into an email and sends it to my mailbox. It is not written to any disk or database on the web server, and nothing about it is kept there once the mail is handed over.
The email address you give is used as the reply address, so that answering you does not require me to copy it anywhere else.
The server logs only that a submission was accepted or rejected. It does not log your name, your address or your message.

After that it lives in my mailbox like any other email: used to answer you, and to run the engagement if one follows. It is not shared with anyone else, and there is nothing on this site that could correlate it with your browsing.

Retention: the web server keeps no copy at all — that is stated above and is a property of how the form is built, not a promise. Once a submission has been turned into an email it lives only in my mailbox, and is deleted when the enquiry is closed and no engagement followed. Ask, and you will be told what is held about you and it will be deleted on request.

Your rights, and how to complain

You can ask what I hold about you, ask for it to be corrected, and ask for it to be deleted where I am not required to keep it. Use the address on the contact page. If you are in the European Union or the United Kingdom you also have the rights to object, to restrict processing, and to receive your data in a portable form.

If you are not satisfied with how I handle a request, you are not limited to complaining to me:

In British Columbia — the Office of the Information and Privacy Commissioner for BC, oipc.bc.ca.
Elsewhere in Canada — the Office of the Privacy Commissioner of Canada, priv.gc.ca.
In the European Union or the United Kingdom — your national supervisory authority.

Which privacy laws were assessed

A practice that sells this analysis should show its own. Each line states the position and the reason for it, so you can disagree with the reasoning rather than take the conclusion on trust.

How this site is run in light of each regime. This is my assessment of my own site, not legal advice, and not a certification of compliance by anyone.
Regime	Position	Reason
PIPEDA (Canada)	Followed	Applies to personal information collected in the course of commercial activity. This page is the openness obligation, and the complaint route to the OPC is above.
BC PIPA	Followed	The practice operates in British Columbia. The designated-individual requirement in s. 4(3) and s. 4(5) is the operative one here and is addressed above.
GDPR / UK GDPR	Treated as applying	Services are offered in Canada and this site is not aimed at the EU market, so the targeting test in Article 3(2) is probably not met. Rather than argue that, this page gives the Article 13 information anyway and the site collects nothing that would need it.
ePrivacy “cookie” rules	Nothing to consent to	The consent requirement is triggered by storing or accessing information on your device. This site does neither.
CalOPPA (California)	Followed as if it applied	Its trigger is collecting personally identifiable information through the site about California residents, which does not happen here. The disclosures it asks for — categories, changes, effective date, Do Not Track — are on this page regardless.
CCPA / CPRA (California)	Out of scope	It applies to businesses meeting revenue or volume thresholds, or that sell or share personal information. None is met, and nothing is sold or shared. Claiming CCPA compliance here would be a claim about obligations that do not exist.
CASL (Canada)	Not engaged yet	It governs commercial electronic messages. There is no mailing list, no newsletter and no outbound marketing email. If that changes, consent and unsubscribe handling come first.

Changes to this page

Material changes are published here with a new effective date. There is no mailing list to notify, by design.