Short version: we collect very little. Long version: below, every item, why we keep it and when it goes.
What we never do
- Set cookies on readers or commenters.
- Run analytics, ads or tracking pixels.
- Sell personal data, or hand it to advertisers.
Everything we keep, and for how long
| Item | Kept for |
|---|---|
| Web server access logs | Roughly two weeks |
| Your IP address, while we screen a comment or message for spam | Held in memory only, never saved |
| A comment still awaiting approval | Up to 30 days |
| A message sent through the contact form | 90 days |
| Approved comments and published posts | Until someone removes them |
If you only read
No account, no cookies, no analytics, no outside scripts. What does exist is the standard access log every web server writes: IP address, the page requested, your browser’s user agent, and the time. We look at it for security and to keep the site up, and the log rolls over and is wiped after around 14 days.
If you leave a comment
We ask for a name and the comment. That is it, no email field, and the name can be anything you choose.
Comments queue for review. An approved comment shows publicly under its post with your chosen name and the date. One that is never approved is removed once 30 days have passed.
If you message us
The form takes your name, email address, the topic you pick and your message. We use them to understand what you need, write back and sort it out, nothing else. After 90 days the message is erased.
For comments and messages alike, the site glances at your IP address to fend off spam. That check happens in memory; the address never reaches the database.
If you write here
Writers come in by invitation. A writer’s profile (name, handle, portrait, short bio, optional website link) and published posts are public, which is the point. Any writer can have posts, or the whole blog, removed on request.
The one cookie
There is exactly one: a session cookie that lets the site recognise an administrator after signing in. If you read or comment, you never get it.
Two outside providers
Some files come from other companies. Your browser asks them for those files directly, so they see your IP address and browser details, like any request on the web:
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com), for the typefaces on every page.
- Unsplash (images.unsplash.com), for the photos on the home page.
Their privacy policies apply to those requests. Nobody else gets information about your visit. Traffic to and from PepPick runs over HTTPS using Let’s Encrypt certificates, so it is encrypted in transit.
Your data, your call
Want to see what we have on you, fix it, or have it erased (a comment you left, a message you sent)? Go to the contact page, choose My data: see it or delete it, and give us enough to find it, such as the post and the name you used. We might ask one question first to make sure the request is really yours.
If this page changes
Any change to how we handle data shows up here, with a new “last updated” date. Collecting anything beyond what is listed above would be announced on this page before it starts.