Privacy
What this site collects — and what it does not.
This is a personal studio site, not a product with accounts. There is no ad network, no data broker, and no cookie-consent wall on v1. What follows is a plain-language summary of analytics, gated case access, and forms — updated as the stack changes. It is not legal advice.
On this page
Jump to a section.
Analytics
Aggregated reach measurement — not a profile of you across the web.
Public pages load two third-party analytics tools:
- Google Analytics 4 (property
G-5TBK1LQYDK) — page views, referrers, and custom events such as gate steps and audio milestones. Google may set cookies and process data under its own policies. - Microsoft Clarity — session replay and heatmaps to understand how pages are used. Clarity may record interactions on the page (clicks, scrolls). See Microsoft’s privacy statement.
There is no ad pixel, newsletter tracking pixel, or social embed that sets marketing cookies on v1. Staging uses the same scripts with debug-friendly event parameters where applicable.
You can block these scripts with a browser extension or network filter. There is no separate on-site consent banner while the public surface stays analytics-only without third-party embeds.
Password gate & cookies
Gated case depth needs a password — not an account.
Some portfolio depth lives at /work/.../full/ and similar routes behind a shared portfolio password. When you unlock:
- WordPress sets a postpass cookie (
wp-postpass_*, HttpOnly, ~10 days) so protected pages load without retyping the password every visit. - Site JavaScript may store unlock flags in
localStorage(studio_gate_unlocked,studio_hp_gate_unlocked) andsessionStorageso bridge pages remember you in the same browser. - A magic access link from email sets the same cookie and storage keys when you open it.
These are functional cookies and storage for access control, not advertising. The same unlock is required for PAI export surfaces (email transcript, shareable takeaway link, and viewing a takeaway page). Clear site data in your browser to remove them. See the colophon for how public and gated content relate.
PAI chat & takeaway
Questions you ask are processed to answer from this site’s corpus.
PAI (Portfolio AI) runs as a separate app on this domain (/chat/ and embeds). When you use chat or optional live voice, your messages (and, for voice, audio for transcription/synthesis as configured) are sent to the server to retrieve relevant site content and generate a reply. That processing uses hosted model APIs (third-party processors). Conversations are not sold or used for advertising.
Chat threads may be stored on the PAI server (SQLite) for a limited retention window so the conversation can continue across turns; they are operator-accessible for support and abuse review, not a public feed. PAI can unlock the same portfolio password inside an iframe (same cookie and storage keys as the main gate).
Session context (after unlock only). When portfolio access is unlocked, the site may send lightweight browse signals (pages opened, section anchors, panel opens, prototype opens) to PAI so an optional visit recap can reflect what you actually looked at. This is not sold as advertising data and is not a cross-site profile. Signals are capped per visit and used to build a takeaway when you opt in.
Get a takeaway / shareable recap. After unlock, you may opt in (footer chip or in-chat request) to build a private recap at an unlisted /takeaway-{hash}/ URL. Building and viewing that page both require the portfolio password. Recaps are not indexed (noindex, robots disallow, excluded from sitemaps and public listings) and expire on a schedule aligned with portfolio access (~10 days). Optional email of the link uses the address you enter and is sent via Mailgun/SMTP. Consent is required on the form. Without unlock, chips stay hidden and a takeaway URL shows an access wall only.
Email transcript (full chat log) is a separate opt-in, also unlock-gated when enabled. On production it may be disabled even when takeaway is available.
Do not paste secrets, government-classified material, or other people’s personal data into chat or takeaway forms. The system is built for public portfolio context, not confidential intake. More on how takeaway fits the site: colophon.
Contact & access requests
Voluntary messages — stored in email, not a CRM.
Contact collects name, email, and message. Submissions are emailed to the operator via WordPress mail (SMTP). They are not stored in the WordPress database as post content. Retention follows the operator’s email provider.
Portfolio access requests (gate “request access” flow) collect email (and optional context) to send a confirmation link and, after approval, a password delivery email. Grant tokens are short-lived transients on the server. Rate limits apply per IP to reduce abuse. PAI takeaway / transcript emails (when you opt in after unlock) are separate from this flow and are described under PAI chat & takeaway.
Hosting & security
Standard web hosting — hardened, not harvested.
The site runs on AWS Lightsail (WordPress, Apache, HTTPS). PAI runs as a Node service on the same host. Server and application logs (IP address, user agent, request path, timestamps) exist for operations and security. Wordfence provides firewall and login protection on WordPress. Email for forms, gate flows, and optional PAI takeaway/transcript mail may route through Mailgun or SMTP as configured on the server.
There is no user account database for visitors. WordPress admin accounts are operator-only and never used to profile readers.
Your choices
You can use the public surface without unlocking anything.
- Block analytics scripts with a browser or network tool.
- Clear cookies and site storage to reset gate unlock state (also clears takeaway chip session flags).
- Skip PAI, takeaway, contact, and access-request forms entirely.
- Email via contact to ask what data was received from a form, access request, or takeaway email.
This site is operated from the United States. Visitors may read from other jurisdictions; processing may occur on U.S. infrastructure and U.S.-based vendors listed above.