The short version: almost nothing.
This is a personal site. It carries no advertising, no analytics, and no third-party scripts of any kind.
What is collected
If you use the contact form: your name, email address and message, plus the IP address and browser user-agent the request arrived with. That is emailed to me and is not stored in any database. The IP address is included so I can tell a real message from an automated one, and it is what the form's rate limit counts against.
If you just read pages: the web server keeps ordinary request logs — IP address, time, URL, response code, user-agent. Nothing is written to a database and no profile is built.
Nothing else. There is no analytics package, no tracking pixel, no advertising network, no social widget, no embedded font service, and no content delivery network. The site's Content-Security-Policy blocks requests to any other origin outright, so a third-party script could not run here even if one were added by mistake.
Cookies
Reading this site sets one cookie: an antiforgery token, issued only when a page containing a form is rendered. It exists to stop a different website from submitting the contact form on your behalf, it contains no identifier, and it is discarded when you close the browser.
A second, authentication cookie exists — but only for me. Signing in is restricted to the site's own account, which is used to publish content. There is no visitor account and no sign-up.
How long things are kept
Contact messages live in my mailbox and stay as long as any other correspondence would. Server request logs are rotated by the web server. Sign-in and account-security records — which concern only my own account — are kept for 400 days and then deleted automatically.
Who else sees it
Nobody. Nothing is sold, shared, or handed to an advertiser or data broker. Mail sent by this site is relayed through servers I run. The site is hosted on my own hardware rather than a third-party platform.
Your requests
If you have written to me and want that message deleted, or want to know what I still have, email steve@stevenwinkelman.com and I will handle it directly. There is no form and no ticketing system — it is one person reading one mailbox.
Security
The site is served over HTTPS only. If you believe you have found a security issue, the address in /.well-known/security.txt reaches me, and a quiet report is always welcome.