Privacy

This is a one-person consultancy site. It does not log you in, does not run ads, does not sell anything subscription-based, and does not have a customer database. What follows is the complete and specific list of what the site collects and what each third-party service does with it — written plainly because that's the only kind of privacy notice worth writing.

What I collect

Aggregated usage stats, nothing identifying. When you load a page, the site records the URL you visited, the referrer (the link you came from), your country (derived from IP, then the IP is discarded), the device class (mobile / tablet / desktop), and the browser family. These numbers are added to a daily total. No cookies are set. No fingerprint is taken. No tracking ID follows you between sessions.

If you focus on the contact form's first field or submit the form, the site records that — as two anonymous counters ("Form Started," "Contact Form Submit") — so I can see how often visitors begin filling out the form versus how often they actually send it. The counters do not include anything you typed.

If you submit the form, your name, email, message, timeline, and budget range are sent to me via Resend (email delivery, see below). I read every message myself. I do not store form submissions in any database — they live in my inbox.

Third-party services

Four services are involved in running this site. Each one is named here with what it does and what it sees.

Plausible Analytics (plausible.io, EU-hosted in Germany, GDPR aligned). Powers the aggregated counters described above. Plausible is cookieless by design. It receives your URL, referrer, country, and device class, hashes your IP into a daily-rotating salted value (never stored as raw IP), and discards the input after computing the hash. The analytics script is served from alborati.com directly as a first-party proxy, so it doesn't appear as a third-party request in your browser — but the data still lands at Plausible. Their full privacy policy: plausible.io/privacy.

Cal.com (cal.com, US- and EU-hosted). If you click the "Book a call" link or the calendar embed on the Contact page, you leave alborati.com and arrive at cal.com. From that point Cal.com handles the booking flow — their cookies, their forms, their privacy policy applies. I receive your name, email, and booking time. The booking creates an anonymous "Cal.com Booking Created" counter on the analytics side so I can measure how many calls land. Cal.com's policy: cal.com/privacy.

Resend (resend.com, US-hosted). Delivers the contact-form email to my inbox. Resend sees your form contents in transit and logs delivery metadata (timestamp, IP of the originating Pages Function, success/failure) per their normal operations. I do not have a Resend retention longer than their defaults. Their policy: resend.com/legal/privacy-policy.

Cloudflare (cloudflare.com). Hosts the site (Cloudflare Pages) and serves DNS. Cloudflare sees every request that hits alborati.com — that's how any host works — and applies edge-level abuse detection (bot scoring, basic DDoS protection). Cloudflare's standard privacy posture applies: cloudflare.com/privacypolicy.

What I don't do

I don't track you across sites. There are no third-party advertising scripts, no Facebook pixel, no LinkedIn Insight Tag, no Google Analytics, no Microsoft Clarity, no session replay (Hotjar / FullStory), no heatmaps, no fingerprinting libraries. The four services above are the complete list.

I don't set cookies. The site does not write to document.cookie at all. (If your browser shows a cookie from cal.com or resend.com after you click their links, that's their domain, not mine.)

I don't sell data. There is no business model on this site that would benefit from selling visitor data. The site exists to introduce me to potential clients, full stop.

I don't profile visitors. The aggregated counters above are the only signal I get; I cannot identify you individually unless you write to me.

Your choices

Opt out of analytics. Plausible respects the browser's Do-Not-Track signal automatically when enabled. If you'd rather not be counted, enable DNT in your browser, or use any tracker-blocker — uBlock Origin and similar tools recognize Plausible and will block it cleanly. The site continues to work; the only effect is I won't see your visit in the daily counters.

Data inquiry. If you'd like a list of any data this site holds about you specifically, email mo@alborati.com. Because the only personal data this site retains is contact-form submissions you sent me yourself, an inquiry will usually amount to me forwarding you the original message.

Right to deletion. If you've written to me and want that message deleted from my inbox, email the same address. I'll confirm when it's done.

Changes

If this policy changes — if I add a service, remove one, or change how something works — I'll update the date at the top and keep the substance plain. I do not anticipate frequent changes; the surface this site exposes to the network is small by design.

Contact

mo@alborati.com for any privacy question. I read messages myself and reply within two business days.