Privacy

What this records

• ts — The moment the page view was recorded.
• path — Which of the site's six tracked page templates was viewed.
• category_id — The sector id, recorded only when the page viewed was a sector page; null for every other page.
• referrer_host — The host of the page that linked here, when one is readable; null for a direct visit, an in-site navigation, or a referrer this instrument could not parse.
• device_class — A coarse device category — desktop, mobile, or tablet — read once from the browser's User-Agent header and then discarded; null whenever the header does not clearly say.
• referrer_kind — Which of four kinds the referrer above was: from elsewhere on this site, absent, unreadable, or from another site.
• utm_campaign — An optional tag carried on the exact link a reader clicked, naming which post the visit came from — never anything about the reader who clicked it.

What that means

• The raw browser User-Agent header is read once, to derive a coarse device category, and then discarded — it is never stored in any column and never written to a log line.
• The beacon that records a page view sets no cookie of any kind.
• Nothing this instrument stores is unique to a reader — there is no visitor id, no session id, no cookie, and no raw or hashed IP address anywhere in this table.
• Page-view rows are kept indefinitely, on purpose, because they carry nothing that could tie a row back to the person who generated it — there is no retention limit and no automatic deletion for this table.
• No third-party or external analytics service is used anywhere on this site; the page-view beacon sends its data to this site's own server and nowhere else.
• A campaign tag, when one is present on the link a reader clicked, names the post it came from, not the reader — and a tag that does not match its own narrow, fixed format is simply left out rather than recorded incorrectly.

If you sign in

Signing in creates a separate, unrelated record. None of the page-view columns above hold any of it, and none of this holds any page-view data.

An account holds an email address on its own row. Each signed-in session separately holds the IP address and browser User-Agent that were present at the moment that session was created.

A reader who never signs in has no session row at all — a session row always names the account it belongs to, so one cannot exist without an account behind it (see the `session` table's own required link to `user` in the file cited below).

This project's only automatic cleanup job (`apps/web/lib/oauth-reap.ts`) removes abandoned OAuth client registrations and nothing else — it never touches a session or account row, and no other job in this codebase does either, so neither is deleted automatically.