Privacy

This is a personal website run by one person. It carries no advertising, no analytics, and no third-party tracking of any kind.

What is collected

If you never create an account, the site stores nothing about you at all.

If you create an account, it stores:

• your email address and the name you chose;
• a cryptographic hash of your password — never the password itself;
• session records, so you stay signed in, including the IP address and browser string of the sign-in;
• anything you deliberately submit, such as comments and reactions.

Sign-in and sign-up attempts are also recorded — the address that was tried, the time, the outcome, and the IP and browser string it came from. This applies to attempts, so an address appears here even if it has no account, which is the point: it is how a run of guesses against one address becomes visible. Passwords are never recorded in this log, not as a value, not as a hash, not as a length. Only an administrator can read it.

If you join the mailing list, it stores your email address and whether you confirmed it. Nothing else.

Cookies

One cookie, for your login session. It is marked HttpOnly, SameSite and Secure, which means it cannot be read by scripts and is not sent to other sites. There are no advertising, analytics, or tracking cookies, so there is no consent banner to click.

Your light/dark preference is kept in your own browser's local storage and is never sent to the server.

Where it is kept

On a server in the United States, in a database only this site can reach. Files are stored with Backblaze, also in the United States. Nothing is sold, rented, or shared with anyone, and no data is passed to any third party for marketing.

How long

Account data is kept until you ask for it to be deleted. Sessions expire after thirty days. Mailing-list records are removed when you unsubscribe, apart from the fact of the unsubscribe itself, which is kept so you are not re-added by mistake.

Your rights

You can ask for a copy of everything held about you, ask for it to be corrected, or ask for it to be deleted — including your account and every comment attached to it. Deletion is permanent. Write to hello@tarandallben.com and expect a reply within a few days.

If you are in the UK or EU, the lawful bases relied on are consent (for the mailing list) and legitimate interest (for running an account you asked for).

Security

The site is served over HTTPS only. Passwords are hashed. Private material is unreachable without the right account, and a request for something you may not see is answered exactly as though it did not exist.

No system is perfect. If you find a problem, please report it to hello@tarandallben.com rather than disclosing it publicly, and you will get a straight answer.

Changes

If this policy changes materially, the date above changes and anyone with an account is told by email.

---

This policy is written to be accurate rather than lawyerly, and has not been reviewed by a solicitor. If this site ever sells anything, it will be reviewed properly first.