Privacy policy | nathangamache.com

The short version

If you send me a message through the contact form, I get your name, your email address, your subject, your message, and your company if you filled that field in. I read it, I reply to it, and I keep it in my email the way I keep any other email. I do not sell it, share it, or add it to a mailing list, because I do not have a mailing list.

If you do not send me anything, the only record of your visit on my own server is in its logs, described under Where the site runs. There are no cookies set by this site, no analytics and no tracking pixels.

What the contact form collects

Five fields, four of them required:

Name, required, so I know who I am replying to.
Email address, required, because it is the only way I can reply.
Company or organization, optional, and only there because it helps me answer usefully.
Subject, required, chosen from a short list so I can tell a project inquiry from a technical question.
Message, required, and whatever you put in it is up to you.

The form also carries two hidden fields that are never shown to a person. Both exist to catch automated submissions. One is left empty by a real visitor and filled in by a bot. The other records when the form was loaded, because a bot sends it the instant the page arrives and a person takes longer than that to type. A submission caught by either is discarded without being read. Neither involves a cookie or anything stored in your browser.

Please do not put anything sensitive in the message. It is an email form on a portfolio site, not a secure channel, and there is no reason for it to carry a password, a payment detail, a government number or anything about your health.

What I do with a message

I read it and I reply to it. That is the whole purpose, and it is the only purpose. A message sent through this form is not used for marketing, is not profiled, and is not fed into any automated decision about you. No AI assistant reads the inbox it lands in.

If your message turns into actual work, the conversation moves to ordinary email and is covered by whatever we agree there.

How long I keep it

Once I have answered a message, I keep it in my email indefinitely. There is no date after which it is deleted on its own. If you want yours deleted, ask and I will delete it. The record Resend keeps of the delivery expires on Resend’s own schedule.

Where the site runs

On my own server, in my homelab in Michigan, in the United States. No hosting company is involved; the machine behind these pages is mine.

Like every web server, it writes an access log: the IP address the request came from, the page asked for, the time, and the browser’s user-agent string. Requests for images, fonts and scripts are left out of it, and so is anything you type into the contact form. It also keeps an error log, which records the IP address of a request that fails, along with what went wrong. This is how servers work and how attacks get noticed. Neither log is joined to anything else, and neither is used to build a picture of a visitor.

Who else sees anything

Three outside companies are involved in this site working at all. This is what each of them sees.

Cloudflare. It sits in front of my server as a proxy, and I use it for caching: it keeps copies of the site’s pages and files and hands them out without asking my server every time. Every request to the site passes through Cloudflare on the way, a message sent through the contact form included. Its Web Analytics, which would add a measuring script to every page, is turned off. The Cloudflare Privacy Policy covers what Cloudflare does with the requests that pass through it.
Resend. The form hands each message to Resend, an email delivery service, which sends it on to my inbox. So it sees what you wrote, with your name and email address, on the way through, and keeps a record of sent emails for a limited time under its own policy. The Resend Privacy Policy covers what it does with them.
My email provider. A message sent through the form is delivered as an email to my inbox, which is hosted by Google (Gmail), so it is stored there the way any other email I receive is. The Google Privacy Policy covers how Google looks after that mailbox.

Nobody else. The fonts are served from this site rather than from Google Fonts, so a typeface request never tells Google you were here. There is no analytics provider, no advertising network, no embedded social widget, no chat bubble, no heatmap, no session recorder and no customer data platform.

Cookies

This site sets none, the contact page included. It does not use local storage or session storage either, and it loads nothing from any other website that could set one. Cloudflare’s Bot Fight Mode, a feature that sets a Cloudflare cookie on visitors, is turned off. There is no cookie banner because there is nothing to consent to.

The one cookie you could still get is Cloudflare’s, not this site’s. If Cloudflare decides a request looks suspicious and shows a security check before the page, passing that check sets a cookie called cf_clearance, so you are not checked again on every page. It is only there to prove the check was passed, and it expires on its own. As far as I know, nothing in my Cloudflare settings shows such a check, so normally you will never get it.

Your rights, and how to use them

Depending on where you live you may have the right to ask what I hold about you, to have it corrected, to have it deleted, to get a copy of it, or to object to my holding it at all. If you are in the EU or the UK this is the GDPR; in California it is the CCPA and CPRA; several other places have their own version.

You do not need to cite any of them. Email nathanpaulgamache@gmail.com and say what you want done. I will answer within thirty days and there is no charge.

For the record: the lawful basis for keeping a message you sent me is legitimate interest. You wrote to me and would presumably like an answer, and once I have answered, I keep the conversation the way I keep any other email.

Children

This site is a portfolio of my work. It is not directed at children and I do not knowingly collect anything from anyone under sixteen. If you believe a child has sent me something through the form, email me and I will delete it.

Changes to this policy

If this changes, the date at the top of the page changes with it. There is no archive of previous versions.

Question about any of this?

Ask me directly and I will answer in plain language. nathanpaulgamache@gmail.com

Get in touch