Privacy / Plain-language operational notice
Your message should not become public data.
Effective 31 July 2026 · This is an operational privacy notice, not a claim of universal legal completeness.
What the contact form collects
The form collects your name, email address, subject, enquiry category, message and, only if you choose to add one, an attachment. A salted hash derived from request information is retained through its abuse-prevention window and removed by the daily cleanup job after expiry.
Why it is collected
The information is used to review and respond to your enquiry, protect the form from spam and maintain a record of relevant correspondence. It is not published or sold.
Attachments and security
Accepted attachments are limited to PDF and common image formats, with a maximum size of 5 MB. File signatures are checked. Images are re-encoded where practical. Files are stored privately and quarantined until a configured scanner marks them clean. If scanning is unavailable, the administrator cannot download the file.
Retention and deletion
Active contact records and stored attachments are deleted after 180 days by default and can be deleted earlier from the private inbox. Provider backup copies may persist until their normal backup-retention period ends. You may request deletion through the contact form.
External services
The production setup may use Supabase for database, authentication and private storage; Vercel for hosting; Resend for email delivery; Cloudflare Turnstile for abuse prevention; and YouTube for video content. Each service processes only the information required for its role.
YouTube and external media
YouTube thumbnails may load from YouTube servers. The privacy-enhanced video player loads only after you choose to play a video; at that point, YouTube may receive device and network information and may set storage or cookies under its own policy.
Analytics and cookies
No optional analytics are enabled by default. Essential authentication cookies are used only for the private administrator portal. A consent banner should be added only if optional tracking that requires consent is actually enabled.
Questions
Use the contact page for privacy questions or deletion requests. Please do not include passwords, passport scans or other unnecessary sensitive data.