privacy

This is the plain-language version of what sonderframe.works (the site) collects about visitors, why, and how to make it go away. The behavior described here matches what the code actually does. If you ever find a discrepancy, that's a bug — please tell me at young@sonderframe.works and I'll fix it.

tl;dr

• Every HTTP request to this site is logged at the edge (Cloudflare). I can see what was requested, when, by which IP, from which country, with which user agent.
• For visitors in the EU, UK, or EEA: no banner, and no cookies unless you ask for them. By default nothing identifies you between visits — no cookies are set, no IP address is stored — only an anonymous, irreversible daily hash plus your country, so I can count visits and see which words are read without knowing who read them. If you want to be counted as a returning reader, or want to make sure you never are, the choice is here: Allow measurement cookies Decline all
• For visitors elsewhere: I track engagement (how far you scrolled, which doors you opened, how long you read) with first-party cookies. This data is used only by me, lives on infrastructure I control, and is never sold.
• Bots and AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Googlebot, etc.) are logged and classified separately. They don't get cookies.
• The Thought-filled Words app sends crash reports (Sentry) and anonymous usage events (which words were viewed, whether the purchase page was reached) tied to a random install ID — no IP, no location, no advertising ID, nothing personal. Details below.
• The site's front page is the Thought-filled Words taster — a small device you can try the app on. It records what you do with it (which words you open, how far you swipe, whether you tap through to a store, which OS apps you open, which photos you look at, plus your browser engine, device class and operating system — Android, iOS, iPadOS, macOS, Windows, Linux or other — which is device-class data and never a fingerprint). We also record how long the page took to work: how long it took to load, how long from your tap until the first picture and the first word, how many of our own loading deadlines we had to give up on, and how busy your browser was, and which loading adaptations were on. These are timings about the software and the connection, not about you — there is no identifier in them and nothing that could be traced back to a person as anonymous events under a per-visit session number that lives only in this tab and dies when it closes. No IP, no name, no account; the same daily hash as above, and the same rule: aggregate counts, first-party only, never sold. If you share a link from inside the taster, the link carries a random eight-character tag so I can count that it was opened and how many people one share reached; the tag is made fresh each time you share, it is never stored on your device, and it says nothing about you and nothing about the person who opens it. Where the taster shows a price before the store button, it records which country’s price list it used — a country, never a location — together with the price shown and whether the button was tapped. When you tap a store badge, the store link carries the campaign tag you arrived with (and, for an ad, Google’s click identifier) so that Google Play can tell the app, on Android, which of my links led to the install; the app records that once and never combines it with anything else.
• On the taster, a store button that isn't live yet offers one line: "Tell me when it's on the App Store." If you type your email there, that address is the only personal thing this site ever stores. It is kept for one purpose — one message when that store goes live — on my own server, never joined to your visit (no session number, no IP, no hash is stored beside it), never shared, and deleted after that one message is sent (or after a year, whichever comes first). To have it removed sooner, email me.
• You can ask me what I have on you, and I'll delete it: email young@sonderframe.works.

what I collect

edge request logs (every visitor, including EU visitors who made no choice)

IP addresses

I store your IP address only if (a) you're outside the EU/UK/EEA, or (b) you chose Allow on this page. Otherwise the IP is used once to compute anon_hash and is never written to disk.

behavioral events (only with consent or outside EU)

A small script sf.js on each page sends additional data about how you read:

• Scroll depth (max percentage you reached).
• Reading milestones (25%, 50%, 75%, 100% of the page).
• Which headings entered your viewport.
• Which links you clicked, and from which section.
• Time on page (wall clock + active time, excluding when the tab was hidden).
• Whether you came from another page on the site.
• Screen size category and viewport dimensions.
• Whether you have "prefers-reduced-motion" enabled.

This data is associated with your _sf_vid cookie (a random ID, see below).

session recordings (Microsoft Clarity) — the taster only, with consent or outside the EU

On the taster (the interactive page at the root of this site), a third-party recorder, Microsoft Clarity, records how the page is used: where you tap, how you swipe, what the page showed at the time. It is the one third-party script on this site, and it runs only:

• for visitors outside the EU, UK and EEA; or
• for visitors inside them who chose "Allow measurement cookies" on this page.

An EU visitor who has made no choice is never recorded. Text you type is masked before it leaves your browser. Clarity sets its own cookies (_clck, _clsk) to tell one session from the next; Microsoft's own privacy statement governs what it keeps, and I keep recordings for the shortest period Clarity offers. What I use them for: to see why a visitor stopped where they did. The recorder is tagged with the same anonymous session key as the events above, never with an email or a name.

cookies (only with consent or outside EU)

None of these are HttpOnly because the analytics script reads them. None are third-party; the session recorder's own two cookies are listed in its section above. All are SameSite=Lax.

browser storage (the web taster)

The taster stores seven small things in this site’s own browser storage, and nowhere else. tfw.visits is a number: how many times this browser has opened the taster. tfw.exp.<id> (today tfw.exp.word1) records which version of the entrance this browser was shown, as a short arm name and the date it was drawn, so that a second visit is not a different experience from the first. tfw.exp.price1 recorded, until 16 September 2026, which version of the store page — whether it showed the price — this browser was shown; the price is no longer shown to anyone, a browser that holds the key keeps it, and nothing reads it any more. tfw.hint.swipe and tfw.hint.card each record that this browser has already been shown one of the two small one-time hints — the picture leaning to show that it can be swiped, and a small mark on the card to show that it can be touched — so that neither is shown again once you have done the thing it was pointing at. tfw.hint.pill and tfw.hint.pill.stage record that the short written instructions on the picture (“swipe all the way”, and the ones that follow it) have been shown and how far you got through them, so neither is shown twice. The sound is off on every visit, and the butterfly that shows you where it is turned on comes every time; nothing about either is stored. (A key named tfw.hint.butterfly, which existed for one afternoon, is deleted on your next visit.) Neither is an identifier. They say nothing about who you are, they cannot be read by any other site, nothing is shared with anyone else, and the only part of them that ever leaves the device is that one short arm name on my own anonymous measurement, which carries no identifier of any kind. Clearing this site’s data in your browser removes them. The app itself keeps nothing of the sort.

ad click ids

If you arrive from one of my own Google ads, the address carries a click identifier Google adds (a gclid). The taster keeps it in memory for that page load only, never in storage, strips it from the address bar at once, and records it on two of its own events: the arrival, and a tap on a store button. Once a week I send those store-button taps back to Google as conversions, so the ads can be read honestly. Visitors in the EEA, the UK and Switzerland are excluded from this at the server before anything is stored. No pixel, no script from Google, and nothing about who you are.

what I do not collect

• Your name, email, or any account info — I have no account system.
• Browser fingerprints (canvas, WebGL, font enumeration, etc.).
• Behavioral data from non-consenting EU/UK visitors.
• Anything from advertising networks or social-media SDKs (there are none on this site). The one third-party script is the session recorder on the taster, described above; it never runs for an EU visitor who has not chosen to allow it.

the mobile app (Thought-filled Words)

The Thought-filled Words app (iOS and Android) sends me two kinds of data. The behavior described here matches what the code actually does, same rule as above.

crash reports (Sentry)

If the app crashes, a crash report goes to Sentry so I can fix it. It contains the stack trace, app version, OS version, and device model — no name, no email, nothing you typed.

usage events (first-party, my own server)

The app records which parts of it get used — a word was viewed, the opening was skipped, the info panel was opened, a setting was changed, the purchase page was reached, a download finished — plus a few health signals (how long the app took to start, whether memory ran low), and whether a tap on the purchase page’s buttons registered — no content, no identifiers. Each event carries the app version, OS version, device class (phone or tablet), and the app's display language.

These events are tied to a random install ID — a number the app makes up the first time it runs. It is not your advertising ID, not your device serial, not derived from anything about you, and deleting the app deletes it. I cannot connect it to you, and I don't try.

The events go to the same infrastructure as the site's analytics (my own VPS — see "who has access"). No IP address and no location are stored with app events — the server writes only what the app sent. There are no advertising SDKs, and nothing is sold or shared for advertising. The one third-party analytics SDK is the session recorder described below.

which free chapter (Android, first launch)

On its first launch, the Android app asks my server which free chapter to show. The request carries no identifier: only a number from 0 to 5 and the version of the app's content. The server reads the country of the network the request came from, uses it to answer, and keeps no record of the address. What it keeps is a count: how many first launches in each country were shown each chapter.

session recordings (Microsoft Clarity) — Android, outside the EU/UK/Switzerland

Since the free-to-install build of late September 2026, the Android app carries the Microsoft Clarity recorder, the one third-party analytics SDK in the app. It reconstructs what the screen showed and where you tapped and swiped, so I can see where a stranger stopped. It starts only when the phone's own region setting is outside the EU, the UK, Iceland, Liechtenstein, Norway and Switzerland — the app never looks up where you are from your network address. A phone set to one of those regions is not recorded at all until the app offers a switch for it (planned) and you turn it on. The recording is tied to the same random install ID as the usage events above, never to a name, an email or an advertising ID; there is nothing to type in the app, so nothing typed can be captured. Microsoft's own privacy statement governs what Clarity keeps; I keep recordings for the shortest period it offers. The iOS app does not carry it.

what the app does not collect

• Your name, email, contacts, photos, or location — the app never asks for them and has no permissions for them.
• Your advertising ID (IDFA / AAID) — never read.
• Anything you could type — there is nothing to type in the app.
• Payment details — purchases are handled entirely by Apple and Google; I see only "a purchase happened," never who or how paid.

app data retention

App usage events are kept for 2 years (a ClickHouse TTL enforces this), then deleted automatically.

Google account data (the advertising tool)

Sonder Frameworks advertises the app with Google Ads. To manage those campaigns I run a small command-line program of my own that signs in to Google with my own Google account and, through the Google Ads API, reads and edits my own advertising account: the campaigns, keywords, ads and their performance reports. That is the only Google data it touches.

• It never asks for, receives, or stores data from anyone else's Google account — there is no sign-in for visitors or readers anywhere on this site or in the app.
• The reports it reads are Google's aggregate campaign figures (impressions, clicks, cost). They contain no personal information about the people who saw or clicked an ad.
• The only thing it sends to Google is the campaign configuration I wrote, and — as described above under ad click ids — occasional server-side conversion counts with no personal data attached.
• It is used only by me, on my own computer; it is not offered to anyone else and shares nothing with third parties.

why I collect it

• Engagement: I want to know if people are reading the long-form pieces, which doors they open, where they bounce. This is what justifies continuing to publish.
• Reach: I want to know where readers come from (countries, networks, referring sites) so I have a sense of whose work this resonates with.
• Bot inventory: I track which AI crawlers fetch the writing, how often, and whether they respect robots.txt. This is a separate ongoing curiosity about the present moment.
• Operations: 404s, latency, error rates — basic site health.

legal basis (GDPR speak)

• Edge logs and aggregate analytics: Article 6(1)(f) — legitimate interest in understanding and operating my own website. Balanced against the privacy impact, which is low: anon_hash is irreversible across days, no PII is stored for non-consenting visitors.
• Behavioral events + cookies for EU/UK visitors: Article 6(1)(a) — explicit consent via the choice on this page.
• Bot / AI crawler traffic: GDPR doesn't apply (no natural person).

how long I keep it

• Edge logs and behavioral events: 5 years. Configurable in the underlying ClickHouse TTL clauses.
• Backups: 30 daily + 12 monthly snapshots, on encrypted Cloudflare R2 storage.

who has access

Just me. No third-party analytics processors, no data brokers. The data lives on a small VPS I rent and on Cloudflare R2 (for backups). No data is shared, sold, or sent to advertisers.

Cloudflare and the VPS host are technical sub-processors: they handle bits flowing across their wires, not analytics queries.

your rights (GDPR / UK-GDPR / CCPA)

• Access — ask me what I have on you, and I'll send it.
• Deletion — ask me to delete it, and I will (the deletion propagates to backups within 30 days).
• Withdraw consent — clear the _sf_consent cookie (you return to the default: nothing set), or choose Decline all above, or just choose "Reject all" next time.
• Correction / portability — same email, same response.

Contact for any of the above: young@sonderframe.works. I'll respond within 30 days as required by GDPR (and usually much sooner).

changes

If I change this page in a way that materially changes what's collected or who has access, I'll bump the date at the top and explain the change here.