Privacy policy: what this site collects, stores and does not track

This is a static site. Every page is a file, generated before publication and served as-is, with no application behind it and no database. That structural fact does most of the work here: a site with no server-side application has very little opportunity to collect anything.

It sets no cookies. There is no login, no session, no shopping basket and no preference store, so nothing needs to be remembered between page views. You will not see a consent banner here because there is nothing to obtain consent for.

It runs no analytics. No Google Analytics, no tag manager, no Plausible, no self-hosted alternative. Nobody is counting visits or building an audience profile. It carries no advertising, no social widgets, no video embeds and no third-party JavaScript of any kind.

Loading a page here makes no request to any server other than this one. The typefaces are served from this domain as woff2 files rather than pulled from a font service, the images are served from this domain, and there is no script, stylesheet, pixel or frame loaded from anywhere else. That matters more than it sounds: every third-party asset a page loads is a request that hands your IP address and user-agent to another company, whether or not the asset itself tracks anything.

What still exists is the server log. The web server that answers these pages keeps standard access records, as essentially every web server does: the requested URL, a timestamp, an IP address and a user-agent string. Those are operational, in that they keep the site running and make abuse identifiable, and they are not analysed to profile visitors, not joined to anything else, and not shared.

A policy that claimed even that away would be untrue. Serving a page requires receiving a request, and a request necessarily carries the address it has to be answered to. The honest statement is not that nothing is observable, but that nothing beyond the mechanics of serving a file is collected, retained for analysis, or passed on.

If you follow an outbound link, you are on someone else’s site under their policy, not this one. Outbound links here point at publications and public sources named in the record.

A privacy policy is an assertion, and most of the ones on the web cannot be checked by the person reading them. The claims here are unusual in that they can be, from your own browser, in about a minute, so rather than ask you to take them on trust, this section says how.

Open your browser’s developer tools and switch to the Network tab, then reload any page on this site. Every entry in the list will show this domain. There will be no fonts.googleapis.com, no analytics endpoint, no advertising or tag-manager domain. Look at the Application or Storage tab and the cookie list for this site will be empty. View the page source and there is no third-party script tag to find.

Those three checks cover almost everything asserted above. What they cannot show you is the server side, because nobody can verify another party’s log retention from outside, which is why that part is stated plainly as a commitment rather than dressed up as a technical fact.

A separate question from tracking, and the more important one on a site like this. Several pages name real living people in professional roles. That information comes entirely from published sources (trade press reporting, company announcements, interviews the subjects gave) and no private information appears anywhere on this site.

Individuals are named only where a published source placed them in a specific role at a specific time, and no page characterises anyone’s conduct or describes anyone’s personal circumstances. The full standard is set out in the charter.

If information about you here is inaccurate or out of date, the record desk handles corrections about named individuals ahead of everything else.