privacy

last updated: 2026-05-16

This is the plain-language version of what sonderframe.works (the site) collects about visitors, why, and how to make it go away. The behavior described here matches what the code actually does. If you ever find a discrepancy, that's a bug — please tell me at young@sonderframe.works and I'll fix it.

tl;dr

Every HTTP request to this site is logged at the edge (Cloudflare). I can see what was requested, when, by which IP, from which country, with which user agent.
For visitors in the EU, UK, or EEA: I show a consent banner. If you decline, no cookies are set, no IP address is stored, and no behavioral tracking happens — only an anonymous, irreversible daily hash plus your country.
For visitors elsewhere: I track engagement (how far you scrolled, which doors you opened, how long you read) with first-party cookies. This data is used only by me, lives on infrastructure I control, and is never sold.
Bots and AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Googlebot, etc.) are logged and classified separately. They don't get cookies.
The Thought-filled Words app sends crash reports (Sentry) and anonymous usage events (which words were viewed, whether the purchase page was reached) tied to a random install ID — no IP, no location, no advertising ID, nothing personal. Details below.
You can ask me what I have on you, and I'll delete it: email young@sonderframe.works.

what I collect

edge request logs (every visitor, including non-consenting EU visitors)

Field	Detail
`ts`	When the request happened, millisecond precision (UTC).
Country, region, city	Derived from your IP by Cloudflare. Used for geographic aggregates.
ASN / network operator	Helps distinguish university/ISP/datacenter traffic.
User-Agent	Your browser / OS, or the bot's identifier.
Referer (hostname only)	e.g. `google.com` — not the full URL.
Path requested, status code, response size, response time	Standard HTTP log fields.
`anon_hash`	An irreversible SHA-256 hash of (IP + UA + today's date + a secret salt), truncated. Resets every UTC midnight, so I can recognize repeat hits within a day but cannot tie one day to another for non-consenting visitors.
Classification	One of `human`, `verified_bot`, `ai_crawler`, `unknown_bot`, `suspicious`. Computed from the user-agent and Cloudflare's bot signals.

IP addresses

I store your IP address only if (a) you're outside the EU/UK/EEA, or (b) you accepted the consent banner. Otherwise the IP is used once to compute anon_hash and is never written to disk.

behavioral events (only with consent or outside EU)

A small script sf.js on each page sends additional data about how you read:

Scroll depth (max percentage you reached).
Reading milestones (25%, 50%, 75%, 100% of the page).
Which headings entered your viewport.
Which links you clicked, and from which section.
Time on page (wall clock + active time, excluding when the tab was hidden).
Whether you came from another page on the site.
Screen size category and viewport dimensions.
Whether you have "prefers-reduced-motion" enabled.

This data is associated with your _sf_vid cookie (a random ID, see below).

cookies (only with consent or outside EU)

Cookie	Purpose	Lifetime
`_sf_vid`	Random visitor ID, used to recognize you across visits. Not linked to any external profile.	1 year
`_sf_sid`	Random session ID, used to group requests within ~30 minutes of activity.	30 minutes, sliding
`_sf_consent`	Stores your choice from the banner (`granted` or `denied`).	1 year

None of these are HttpOnly because the analytics script reads them. None are third-party. All are SameSite=Lax.

what I do not collect

Your name, email, or any account info — I have no account system.
Browser fingerprints (canvas, WebGL, font enumeration, etc.).
Behavioral data from non-consenting EU/UK visitors.
Anything from third-party tracking pixels, advertising networks, or social-media SDKs (there are none on this site).

the mobile app (Thought-filled Words)

The Thought-filled Words app (iOS and Android) sends me two kinds of data. The behavior described here matches what the code actually does, same rule as above.

crash reports (Sentry)

If the app crashes, a crash report goes to Sentry so I can fix it. It contains the stack trace, app version, OS version, and device model — no name, no email, nothing you typed.

usage events (first-party, my own server)

The app records which parts of it get used — a word was viewed, the opening was skipped, the info panel was opened, a setting was changed, the purchase page was reached, a download finished — plus a few health signals (how long the app took to start, whether memory ran low). Each event carries the app version, OS version, device class (phone or tablet), and the app's display language.

These events are tied to a random install ID — a number the app makes up the first time it runs. It is not your advertising ID, not your device serial, not derived from anything about you, and deleting the app deletes it. I cannot connect it to you, and I don't try.

The events go to the same infrastructure as the site's analytics (my own VPS — see "who has access"). No IP address and no location are stored with app events — the server writes only what the app sent. There are no third-party analytics SDKs, no advertising SDKs, and nothing is shared with anyone.

what the app does not collect

Your name, email, contacts, photos, or location — the app never asks for them and has no permissions for them.
Your advertising ID (IDFA / AAID) — never read.
Anything you could type — there is nothing to type in the app.
Payment details — purchases are handled entirely by Apple and Google; I see only "a purchase happened," never who or how paid.

app data retention

App usage events are kept for 2 years (a ClickHouse TTL enforces this), then deleted automatically.

why I collect it

Engagement: I want to know if people are reading the long-form pieces, which doors they open, where they bounce. This is what justifies continuing to publish.
Reach: I want to know where readers come from (countries, networks, referring sites) so I have a sense of whose work this resonates with.
Bot inventory: I track which AI crawlers fetch the writing, how often, and whether they respect robots.txt. This is a separate ongoing curiosity about the present moment.
Operations: 404s, latency, error rates — basic site health.

legal basis (GDPR speak)

Edge logs and aggregate analytics: Article 6(1)(f) — legitimate interest in understanding and operating my own website. Balanced against the privacy impact, which is low: anon_hash is irreversible across days, no PII is stored for non-consenting visitors.
Behavioral events + cookies for EU/UK visitors: Article 6(1)(a) — explicit consent via the banner.
Bot / AI crawler traffic: GDPR doesn't apply (no natural person).

how long I keep it

Edge logs and behavioral events: 5 years. Configurable in the underlying ClickHouse TTL clauses.
Backups: 30 daily + 12 monthly snapshots, on encrypted Cloudflare R2 storage.

who has access

Just me. No third-party analytics processors, no data brokers. The data lives on a small VPS I rent and on Cloudflare R2 (for backups). No data is shared, sold, or sent to advertisers.

Cloudflare and the VPS host are technical sub-processors: they handle bits flowing across their wires, not analytics queries.

your rights (GDPR / UK-GDPR / CCPA)

Access — ask me what I have on you, and I'll send it.
Deletion — ask me to delete it, and I will (the deletion propagates to backups within 30 days).
Withdraw consent — clear the _sf_consent cookie and the banner will reappear, or just choose "Reject all" next time.
Correction / portability — same email, same response.

Contact for any of the above: young@sonderframe.works. I'll respond within 30 days as required by GDPR (and usually much sooner).

changes

If I change this page in a way that materially changes what's collected or who has access, I'll bump the date at the top and explain the change here.

← back to sonderframe.works