Privacy Policy

Summary

This is a personal site. It runs no analytics, sets no cookies of its own, has no accounts or logins, and shows no advertising. The only place it asks for personal information is the enquiry form on the services page, and what you send there is emailed to me rather than stored in a database.

The rest of this page is the detail: who I am, what happens to an enquiry, what my hosting provider sees, what is still held from an email list that ran in 2025, and how to get any of it deleted.

1. Who is responsible

Samuel K. Norton, a sole trader based in Sydney, Australia, is the data controller for this site. You can reach me at sam@samue.lk. This policy covers samue.lk and the API at secrets.samue.lk that serves its content. It does not cover other sites I link to, which have their own policies.

2. What this site does not do

• No analytics, page-view counters, tracking pixels or session recording
• No cookies set by this site, and no cookie consent banner because none are needed
• No accounts, logins or social sign-in on the public site
• No comments, profiles or user-submitted content
• No advertising, ad networks or behavioural profiling
• No selling, renting or trading of personal information, in any circumstance

3. Storage in your browser

If you use the light/dark toggle, your choice is saved in your browser's local storage under the key theme-preference. It is written only when you click the toggle, it never leaves your device, and clearing your browser data removes it. Nothing else is stored on your device.

4. The enquiry form

The form on the services page collects only what you type into it:

• Your name and email address
• Engagement type, type of work, budget band and timeline
• What you want to build, and what you have already tried

A submission is not written to any database. It is sent through Resend, an email delivery provider, and arrives in my inbox as an email with your address set as the reply-to. I use it to reply to you and to work out whether the engagement is a fit. I do not add you to any mailing list, and I do not pass it to anyone else.

The lawful basis is taking steps at your request before entering into a contract, and my legitimate interest in responding to people who contact me about work.

Enquiry emails stay in my inbox while the conversation is live and, if we work together, for as long as the engagement records need to be kept. Enquiries that go nowhere are deleted once it is clear they have. Ask me to delete yours sooner and I will.

5. Spam protection on the form

The services page loads Cloudflare Turnstile to tell people apart from bots. Turnstile receives your IP address and signals about your browser in order to score the request, and it runs only on that page. Cloudflare processes this on my behalf as a data processor.

6. Email updates

There is currently no way to subscribe to anything on this site. A signup form existed in 2025 and a small number of email addresses were collected through it. No marketing or newsletter email has ever been sent to that list. The addresses are still held because I expect to bring email updates back.

The lawful basis is consent, given at signup. If and when email updates return, everyone on that list will first receive a single message asking them to confirm they still want to hear from me, and anyone who does not confirm will be deleted. Every email will carry a one-click unsubscribe link.

You do not have to wait for that. Email sam@samue.lk and I will remove you.

7. Legacy account records

The site once offered accounts and social sign-in. Those features are not available on the public site. A small number of records from that period — email address, display name, sign-in provider and session rows — remain in the database, and they are retained alongside the email list described above. They are not used for anything, and you can have yours deleted on request.

8. Hosting and server logs

The site and its API run on Cloudflare. Like any web host, Cloudflare processes your IP address, the page you requested, your user agent and similar request metadata in order to deliver the page and to protect against attacks and abuse. Operational logs from the API are retained by Cloudflare for a short period and are used for debugging, not for building any picture of who you are. Cloudflare acts as my processor for hosting, the CDN, Turnstile, and the database, cache and image storage behind the site.

9. Embedded content

Some essays embed video from YouTube. Where that happens, your browser contacts Google directly to load the player, which means Google receives your IP address and may set its own cookies on that page. This is outside my control and is governed by Google's privacy policy. Images on the site are served from my own storage, not a third party.

10. Who processes data for me

• Cloudflare — hosting, CDN, Turnstile, database, cache and image storage
• Resend — delivery of enquiry-form emails, and of email updates if they return
• My email provider — storage of the enquiry emails once they arrive
• Google / YouTube — only where an essay embeds a video

11. International transfers

I am based in Australia and these providers operate globally, so your information may be processed outside your own country, including in the United States. Where information moves out of the UK or the EEA, the providers rely on standard contractual clauses or an equivalent approved safeguard.

12. Your rights

Depending on where you live, you have some or all of the following rights over information I hold about you:

• Access — ask what I hold and get a copy
• Correction — have inaccurate information fixed
• Deletion — have it erased
• Restriction and objection — limit or object to how it is used
• Portability — receive it in a portable format
• Withdraw consent — at any time, without affecting anything done before

Email sam@samue.lk and I will respond within 30 days. If you are unhappy with how I have handled it, you can complain to the Information Commissioner's Office in the UK, the Office of the Australian Information Commissioner in Australia, or your local supervisory authority.

13. Children

This site is not directed at children under 16 and I do not knowingly collect their personal information. If you believe a child has sent me something through the enquiry form, tell me and I will delete it.

14. Changes to this policy

If what the site does changes, this page changes with it and the date at the top is updated. There is no version history, so the page always describes the site as it is today.

15. Contact