Privacy note

What a visit records

Each browser tab that opens the site starts a session. It records your IP address, your browser's user-agent string, the kind of device (desktop, mobile or tablet), when the session started, when it was last active and how it ended.

While the tab is open, the session records these events, each with the time and the section of the page:

page_view

Which section of the site you opened.

click

The kind of element you clicked (a link or a button), whether it has an id, and, for a link, the site it points to. Never the text you clicked.

scroll_depth

How far down the page you scrolled.

terminal_command

A command typed into the site's terminal, and whether it was recognised.

theme_change

Switching between the light and dark themes.

copy_email

That you copied the contact address, and whether the copy worked.

contact_prompt

Which suggested topic you loaded into the contact form.

contact_submission

That the contact form was sent or failed, and by which route. Your message itself is emailed, not stored here.

ai_llm_telemetry

For each reply from the AI chat: the model, how many tokens it used, and how long it took. Not the words of the conversation.

client_error

The type and message of a script error on the page, so it can be fixed.

Visit records are never linked to an account, even when you are signed in. You can watch your own session record itself, live, in the Activity section.

What your browser keeps

• One cookie, rj_session_token, which proves a session is yours. It is HttpOnly and SameSite=Strict, and it lasts 24 hours.
• For the open tab only (sessionStorage): the session's id and token.
• On this device (localStorage): your theme and colour choices, events waiting to be sent, your terminal history, chats you started here, the Dev Tools' own settings, and, when you sign in, your sign-in tokens. Chats that belong to an account are removed from the browser when you sign out.

If you create an account

An account stores your email address and an optional display name. Your password is kept only as a hash, along with earlier hashes so an old password cannot be reused. It also stores:

• each sign-in: the time, the IP address, the browser and the method used;
• each device signed in: its IP address, browser and device type;
• your two-factor secret, if you turn two-factor sign-in on;
• the conversations you have with the AI chat while signed in, so you can return to them.

Who else receives anything

• Amazon Bedrock receives the messages you send the AI chat, to write the reply.
• Have I Been Pwned is asked whether a new password has appeared in a breach. It receives only the first five characters of the password's SHA-1 hash, never the password.
• FormSubmit relays a contact message only when this site's own server cannot be reached. Otherwise the site's server emails your message straight to me.

That is the whole list. Fonts, icons and scripts are served by this site itself, and no other service is contacted while you browse.

Who can see it

• The site owner can see everything described here, including each IP address with its visits and the list of accounts.
• People the owner makes superusers can see totals only: how many sessions and events, which sections and terminal commands, which devices, and how much the AI chat was used. They cannot see IP addresses or accounts.

How long it is kept

IP addresses are stored in full, and visit records do not expire.

If you delete your account, you have 30 days to change your mind: signing in again restores it. After that the account is deleted, together with its sign-in history, devices, password history and saved conversations. Visit records were never linked to the account, so they are not affected.

Questions, or a request to delete

Use the contact form or email inboxtorj@gmail.com.