What I collect, how I use it, where it's stored.

Three sources, all narrow.

Contact-form submissions.

When you send a message via the contact form, I collect the name, email address, and message body you supply. Nothing else from that page is captured — no field is hidden or implicit. A single anti-spam token from Cloudflare Turnstile is also sent with the submission and discarded after verification.

Cookieless analytics.

Cloudflare Web Analytics counts page views in aggregate. It runs without cookies and without storing IP addresses against individual visitors. I see counts of how many times each page was viewed; I do not see who you are, what you did before arriving, or where you went after.

First-party event log.

When the contact form successfully sends, the server logs a single line recording that a submission happened, the date, and nothing else. There is no name, email, or message in this log — it exists only so I can count how often the form is used over a month.

What I don't collect.

No advertising cookies, no remarketing pixels, no cross-site identifiers, no social-network tracking, no fingerprinting beyond what Cloudflare Turnstile uses to decide whether a form submission looks like a bot.

The site runs on Cloudflare Pages, which is a global edge network. That means HTTP requests, including form submissions, transit Cloudflare data centres outside Australia (often closest to where you are visiting from). The form's contents are not held by Cloudflare beyond the time it takes to forward them.

Outbound email is sent via Resend, a transactional email provider with infrastructure in the United States and (for bounce handling) the Asia-Pacific region. Once a message is delivered to my inbox, the copy in Resend's logs is retained per their published policy and is not used by me beyond debugging delivery if needed.

My inbox is on Google Workspace. Once an enquiry arrives, it is held there subject to Google's usual retention.

Anti-bot protection uses Cloudflare Turnstile, which evaluates a short-lived challenge token. Turnstile does not set persistent cookies and does not build a cross-site profile.

Some of these providers process data outside Australia (United States, Asia Pacific, European Union — whichever is closest in the providers' edge network). By submitting the contact form, you consent to that cross-border handling, which is necessary for the site to function. I have no separate database or storage layer beyond what is described here.

Under the Australian Privacy Principles, you have the right to:

• Ask what personal information I hold about you.
• Ask me to correct any of it that's wrong.
• Ask me to delete it (subject to any record-keeping obligations I owe you).
• Make a privacy complaint, first to me and then — if you're unsatisfied — to the Office of the Australian Information Commissioner.

For any of these, email [email protected]. I'll reply within a business day, and substantively within thirty days.

If you're not satisfied with how I've handled a privacy concern, you can contact the OAIC at oaic.gov.au/privacy/privacy-complaints.