The short version: nobody else gets any of it.
This site carries no advertising and no third-party scripts of any kind. It does count its own visitors — with its own code, into its own database, on my own hardware.
What is collected
If you use the contact form: your name, email address and message, plus the IP address and browser user-agent the request arrived with. That is emailed to me and is not stored in any database. The IP address is included so I can tell a real message from an automated one, and it is what the form's rate limit counts against.
If you just read pages: the site records the request — time, path, response code, how long the server took to answer, your IP address, your browser's user-agent, and the referring page if your browser sent one. That goes into a database of mine, so I can see which writing gets read, what search engines and AI crawlers actually fetch, and which pages are slow or broken.
A small script measures what the server cannot. How quickly the page became usable, how long you stayed, how far down you read, and whether you followed a link off the site. It is served from this domain, reports only to this domain, and sets no cookie or identifier. Block it and nothing else changes — the counts above are taken by the server, which is exactly why they do not depend on it.
Still no third parties. There is no Google Analytics, no hosted analytics service, no tracking pixel, no advertising network, no social widget, no embedded font service, and no content delivery network. The site's Content-Security-Policy blocks requests to any other origin outright, so a third-party script could not run here even if one were added by mistake. The reason these analytics were written from scratch instead of bought off a shelf is precisely that: adding somebody's tag would have meant handing them your visit.
Cookies
Reading this site sets one cookie: an antiforgery token, issued only when a page containing a form is rendered. It exists to stop a different website from submitting the contact form on your behalf, it contains no identifier, and it is discarded when you close the browser.
A second, authentication cookie exists — but only for me. Signing in is restricted to the site's own account, which is used to publish content. There is no visitor account and no sign-up.
How long things are kept
Individual requests, including IP addresses, are deleted after 90 days. What survives is a daily summary per page — how many views, how many distinct visitors, how many were crawlers, how fast it was. Those summaries carry no address and describe nobody, which is what makes it reasonable to keep them indefinitely. Measurements from the script are deleted after 60 days.
Contact messages live in my mailbox and stay as long as any other correspondence would. Sign-in and account-security records — which concern only my own account — are kept for 400 days and then deleted automatically.
Who else sees it
Nobody. Nothing is sold, shared, or handed to an advertiser or data broker. The analytics run on the same server that served you this page and are read by me, on an admin page of this site. Mail sent by this site is relayed through servers I run. The site is hosted on my own hardware rather than a third-party platform, and there is no content delivery network in front of it — partly so that nobody sits between you and me at all.
Your requests
If you have written to me and want that message deleted, or want to know what I still have, email steve@stevenwinkelman.com and I will handle it directly. That includes the request records: tell me the address you browsed from and I can find and delete them. There is no form and no ticketing system — it is one person reading one mailbox.
Security
The site is served over HTTPS only. If you believe you have found a security issue, the address in /.well-known/security.txt reaches me, and a quiet report is always welcome.