Privacy Policy

What you send me

The contact form

Your name, your email address, your company if you add it, the next step you want, and your message. It reaches my mailbox through Resend, an email delivery service. I read these myself, and sending one does not add you to a mailing list. Nothing on this site obliges you to send anything: the form is the way to reach me, and if you would rather not use it, the only consequence is that I cannot reply. Resend keeps its own copy and delivery record for thirty days. Once the message reaches my mailbox I keep it indefinitely, unless you ask me to delete it, which I will.

Ask Kevin

Ask Kevin is an AI assistant that answers from my published work. In Standard mode, your question and the identifiers of the matching passages go to this site's server, which sends them to a hosted AI model through OpenRouter. Each request tells OpenRouter to route only to providers that do not collect it for their own purposes, which rules out training on what you typed. Prompt logging is turned off on my OpenRouter account, so OpenRouter keeps the record of how the request was routed and not the words you typed, except where it says it must keep more, for abuse detection, security, billing or the law. How long the provider that answers keeps a request in its own logs is set by their policy, not by this site. This site keeps no conversation history: your question and the answer are not saved on the server, and nothing here builds a record of what you have asked. There is one transient exception, in your own browser, and you should know about it: if you start a question on the home page, the text goes into your browser's session storage for the moment it takes to carry it to the Ask page, which reads it and deletes it. It is listed with everything else this site puts in your browser on the Cookie Policy. In Local Only mode your question stays in this tab and nothing is sent anywhere. Please leave out confidential or personal details: whatever you type is what gets sent.

Anything you choose to send

The control that lets you question a sentence in an answer, and the follow-up form, send what you type to me by email, the same way the contact form does.

What the site collects on its own

Request details

When your browser asks for a page, the hosting service (Fly.io, in the United States) receives your IP address, your browser type and the address you asked for, because no server can answer a request without them. What a host receives to serve a page is a different question from what it writes down, so here are both. This site writes no log of its own. Fly documents a search window of about seven days for the application logs its platform collects; that window is Fly's schedule and not a setting of mine, and what else the platform holds about a request is Fly's to describe rather than something I can verify from outside it. On my own side, no log drain is configured, so nothing here forwards those logs to another company.

Rate limits

So that one sender cannot flood the forms or the assistant, the server counts recent requests against the address they came from. That count lives in the running server's memory: the address as a key, and a few timestamps. It is not written to a file, a log or a database. Old entries are dropped when the list reaches its size limit rather than on a timer, and the whole thing is gone whenever the server restarts or a new version deploys, which is often. There is no fixed period, so I am not going to name one.

Your approximate country

The server works out which country your IP address belongs to, so it can show you the consent notice that applies where you are. That lookup happens here: your address is checked against a database file licensed from MaxMind, Inc. that sits on this server and is queried locally, and your IP address is not sent to MaxMind. The file itself is a copy I download from MaxMind under my own licence, which carries my account details and nothing about you. The lookup stores no IP address of its own. What it produces is a region code and a two-letter country code, kept in a cookie that ends with your browsing session. If you then make a choice about analytics, the same two values are recorded alongside it, so I can show which rules applied when you decided; that record lasts twelve months. See the Cookie Policy.

Visit counts

Google Analytics counts visits and shows me which pages get read. In the European Economic Area, the United Kingdom and Switzerland it stays off until you allow it. Elsewhere it is on unless you opt out. When it runs, Google receives the pages you view, the site you came from, your browser and device type, and an approximate location worked out from your IP address; Google states that Analytics does not log or store IP addresses. Google Signals and ads personalization are off, and I use none of Google's advertising features. How long any of it is kept is set out under How long it is kept, below.

The spam check

When you send a message or ask a question in Standard mode, Cloudflare Turnstile runs a bot check in your browser. Cloudflare receives signals such as your IP address and browser details to tell people from bots, and this site sends Cloudflare your IP address along with the check result. The check is not used on the fit reader.

The film

The short film on the homepage is hosted by Cloudflare Stream. Nothing is requested from Cloudflare until you press play. From then on your browser fetches the video from Cloudflare's network, which sees your IP address and browser details the way any web server does. When I checked on 12 September 2026, playing the film set no cookies and stored nothing in the browser. The still image and the captions come from this site.

What the site does not collect

• The fit reader runs in your browser. The job description you paste never leaves the tab. It is not uploaded to this site or to anyone else, it is not logged, and it is discarded when you clear it or close the tab. A published test on the evaluation record checks this on every release.
• No accounts and no user database. There is nothing to sign up for.
• No advertising trackers, no data brokers, no sale of personal information. I do not buy data about you, I do not sell your personal information, and I do not share it for advertising. The services that do receive information so the site can work are listed under Who receives it.

How I use it

• Replying to you. Your message and email address are used to answer it.
• Answering questions. Your Ask Kevin question is used to generate the answer, once.
• Keeping the forms usable. The spam check and rate limits stop bots and floods.
• Understanding what gets read. Analytics tells me which pages matter to visitors.
• Meeting legal duties. Where a law requires me to keep or produce something.

Legal bases for visitors in the EEA, UK and Switzerland

Who receives it

These are the services that receive information from this site.

What the AI providers are not sent: anything from the contact form, and anything you paste into the fit reader, which never leaves your browser at all. Your question itself is sent word for word, so if you type your name or your email address into it, that goes too. I do not attach your identity to a question, because this site does not know it.

Your choices

• Analytics. Change your choice at any time with the Cookie preferences control at the bottom of every page, or on Your Privacy Choices. If your browser or an extension sends a Global Privacy Control signal, this site treats it as an opt-out from analytics, wherever you are and with no clicks needed. What happens if you also allowed analytics here yourself depends on two things: where you are, and whether that permission is still current. Where the rules ask your permission before analytics may run, as in the EEA, the UK and Switzerland, or where this site cannot work out which country you are in and applies those rules anyway, a permission you gave on this site while those rules applied to you, and that has not expired or been overtaken by a change to this policy, is the more specific act and it stands until you change it. Everywhere else the browser signal wins, even over a permission you gave here, and analytics stays off.
• Ask Kevin. Use Local Only mode and nothing you type leaves the tab.
• The forms. They are optional. Nothing on this site requires you to send anything.
• Your message. Ask me to delete a message you sent, through the contact form, and I will.

How long it is kept

• Contact messages: I keep them in my mailbox indefinitely. There is no scheduled deletion, and I would rather tell you that than name a date I do not keep to. Ask me through the contact form and I will delete yours. Resend, which delivers the message to me, keeps its own copy and delivery record for thirty days and then deletes it.
• Ask Kevin questions: this site keeps none. The request is made, the answer comes back, and nothing is written down here. Prompt logging is turned off on my OpenRouter account, so what OpenRouter keeps is the routing record, which model answered and how many tokens it took and what it cost, and not the words you typed. It can still keep more where it says it must, for abuse detection, security, billing or the law. The provider that answers keeps whatever its own policy allows, and requests go only to providers that do not collect the question for their own use.
• Analytics: two periods, set separately in the Google Analytics property, and they do not behave the same way. Event data, the record of a page being viewed, is kept for fourteen months from the event, and that period is fixed: coming back does not extend it. User data, the part tied to a single browser, is also kept for fourteen months, and there the clock restarts each time that browser returns, so an active visitor's user record can outlast fourteen months from their first visit. Google deletes expired data on a monthly cycle. Aggregate reports, which count visits without identifying a browser, are governed by neither setting and Google keeps them.
• The rate-limit counters: in the running server's memory only, never on disk. Entries go when the list fills up or when the server restarts, whichever comes first, and a deploy restarts it.
• Your consent choice: twelve months in a cookie in your browser.
• The spam check receipt: thirty minutes in a cookie in your browser, or five minutes when the spam-check service was unreachable and the site let you through anyway.
• Logs at the host: Fly.io runs the server. Fly documents a search window of about seven days for the application logs its platform collects, which is Fly's schedule and not a setting of mine; what else the platform retains about a request is Fly's to state and not mine to guarantee. On my side no log drain is configured, so nothing here forwards those logs to another company.

Security

Every connection uses HTTPS. The forms sit behind a spam check and rate limits. There are no stored passwords because there are no accounts. The spam check receipt is a short-lived signed token holding what it was cleared for, when it expires, whether the check was unavailable, and a random value that makes one receipt different from another. It is never used to recognise you, it is tied to nothing about you, and it expires on its own.

If personal information I hold were exposed, I would tell the people affected as quickly as I could, and in any event within the time the law requires.

Children

This site is for businesses and hiring managers. It is not directed at anyone under sixteen, and I do not knowingly collect information from them. If you think a child has sent me something, tell me through the contact form and I will delete it.

Visitors in the EEA, UK and Switzerland

I am based in the United States. The services above process information there and, in the case of the model provider that answers an Ask Kevin question, possibly elsewhere. I am not a lawyer, and what follows is a factual record rather than legal advice. It says what each of those companies publishes about how it protects information that leaves Europe. It does not claim that any of these arrangements discharges an obligation I owe you.

I checked each of them against the United States Department of Commerce Data Privacy Framework List on 11 September 2026, and I check again at least once a year. Certifications lapse and terms change, so what follows is what was true on that date. The EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework are three separate certifications, held separately, so each one is named on its own below. Each is verified by the company's own self-assessment rather than by an outside audit, and the List records companies rather than products.

• Resend, which delivers your message to my mailbox, is listed under the EU-US Data Privacy Framework and under its UK Extension. Both entries read "Active - Re-certification under Review", and both are scoped to what the List calls non-HR data, meaning data that is not about a company's own employees. Resend is not certified under the Swiss-US Data Privacy Framework. Separately from the framework, its data processing agreement carries the European Commission's standard contractual clauses of 4 June 2021, module two, controller to processor, under Irish law, and Resend says those clauses stand on their own rather than depending on its certification. Transfers from Switzerland run on those same clauses with the modifications in section 6.5 of that agreement, which make the Swiss Federal Data Protection and Information Commissioner the supervisory authority. For Swiss data that is the only route.
• Cloudflare, Inc., which runs the spam check and streams the film, was listed under all three certifications on that date. The listing is for Cloudflare, Inc. and no other company in its group. Its data processing terms hold the same standard contractual clauses ready to apply if that certification lapses or is invalidated, so those clauses are a standby and not what is in use today.
• Google LLC, which provides Analytics and Tag Manager, was listed under all three certifications on that date. Google says it relies on the EU-US Data Privacy Framework for transfers of EEA information to the United States for its advertising and analytics products as of 1 September 2023, and that it relies, in certain circumstances, on the UK Extension and the Swiss-US Data Privacy Framework for transfers from the UK and Switzerland as of 16 September 2024. Google acts as a processor for Analytics and for Tag Manager under the Google Ads Data Processing Terms, to the extent the use falls within the scope of those terms, and each of the two products reaches those terms through a contract of its own. For some configurations and purposes Google acts as an independent controller under its own separate terms. Those Ads Data Processing Terms provide that if Google stops relying on that framework, the European Commission's standard contractual clauses apply instead. Those clauses are a standby, not the mechanism in use today.
• Fly.io, Inc., which hosts the site, was listed under all three certifications on that date, with no other company on the listing.
• OpenRouter, Inc., which routes an Ask Kevin question to a model, does not appear on the Data Privacy Framework List at all: not under any of the three certifications, and not under any status. Its own help centre says a signed data processing agreement is available only to enterprise-tier customers. The mechanism for OpenRouter is under review, and I will state it here once it is settled. Until then, Local Only mode sends nothing to OpenRouter at all. OpenRouter also publishes its list of sub-processors with model providers as a single entry and their location given as "Various", and the provider that answers a given question can change without notice.
• MaxMind, Inc. receives nothing about you, because the country database is queried on this server. There is no transfer here for a mechanism to cover.
• The mailbox itself. Which of Google's terms govern my Google Workspace mailbox turns on a setting I have not finished checking, so I am not naming what covers that leg until I have. Analytics and Tag Manager, in the entry above, reach Google's processor terms by their own routes, and neither is the mailbox's.

Ask me through the contact form and I will send you a copy of the clauses, or a link to a certification, for any provider that has one, and tell you plainly where one is missing. What I keep is my own reading of what these companies publish, not legal advice.

You have the right to ask what I hold about you, to correct it, to have it deleted, to restrict or object to its use, to receive a copy in a portable form, and to withdraw consent at any time without affecting what was done before you did. Use the contact form for any of these. You can also complain to your data protection authority.

US state privacy rights

Notice at collection

Categories collected: identifiers and contact details you send through the forms; the text you type into Ask Kevin in Standard mode; internet activity in the form of page views, once analytics is allowed. Purposes and retention are set out above. I do not sell personal information, and I do not share it in the sense those laws use, which is disclosing it so that advertising can follow you across other companies' sites. I have not done either in the past twelve months. I do pass information to the service providers named above so the site can work, which is a different thing and is listed in full.

Your rights

Depending on your state you may have the right to know what I hold, to delete it, to correct it, to opt out of sale, sharing and targeted advertising (none of which happen here), and not to be treated differently for exercising a right. Use the contact form; I will confirm who you are by replying to the address you give. Global Privacy Control is honored as an opt-out of analytics on Your Privacy Choices.

Visitors in Canada

Canada is one of my primary markets, and I handle information from Canadian visitors as this page describes. You can ask what I hold about you and challenge its accuracy through the contact form, and you can complain to the Office of the Privacy Commissioner of Canada.

Quebec

I do not advertise in Quebec and I do not go looking for clients there. Where Quebec's law does reach what this site does, this page is also the confidentiality policy that law asks for. I am the person responsible for protecting the personal information this site handles, and the contact form reaches me. What the site collects is held and processed outside Quebec: in the United States, and at the other provider locations set out under Who receives it above. No decision about you is made automatically here: Ask Kevin answers questions about my work, and the job description reader runs in your browser and sends nothing anywhere.

Changes

When this page changes, the date at the top and the change log beside the contents change with it. If what the site asks your permission for changes in a way that matters, the site asks again.

Contact

Fincel Design, LLC is responsible for the processing described here. The contact form reaches me fastest and is the best way to ask me anything on this page. The company's address of record is Fincel Design, LLC, c/o United States Corporation Agents, Inc., 476 Riverside Ave., Jacksonville, FL 32202, United States.