Legal
Privacy Policy
Effective date: 12 October 2026 · Last updated: 12 October 2026
The short version
Most of this site needs a free account. To make one, you give an email address, and the site sends you a code and a link to sign in. The site keeps your email address and the things you choose to post. It has no analytics, no advertising, no tracking pixels and no third-party cookies, and it sells nothing about you. You can delete your account yourself on your account page, and the deletion removes the data rather than hiding it.
The rest of this page gives the detail.
1. Who is responsible
Jesse Hawkins, Iowa, United States, runs this site and decides how it uses your data. Contact: [email protected].
2. If you only read the home page
You need no account and the site sets no cookie. Cloudflare, which hosts the site, processes your IP address, your browser’s user agent and the address of the page you asked for, so that it can serve the page and protect the site from attack. This happens on every site that Cloudflare hosts. The typefaces are served from this site, so reading a page sends nothing to Google or to any other font service.
3. If you sign in
Every page except the home page, this page, the Terms, the contact page and the sign-in page needs a free account. Anyone can make one.
3.1 What the site stores
| Data | Why | How long |
|---|---|---|
| Email address | It is how you sign in. There are no passwords: you sign in with a code or a link sent to this address. | Until you delete your account |
| Display name | Shown next to anything you post. The site makes it from your email address and a short random suffix. You do not choose it. | Until you delete your account |
| Account dates | When you made the account and when you last signed in. | Until you delete your account |
| Workspace record | A private record made for each account, so that later features can belong to an account. Nobody else sees it. | Until you delete your account |
| Sign-in link records | A hash of the one-time link, the email address it went to, its expiry, and the consent token described in § 3.4. For the 8-digit code in the same email: a hash of the code, a hash of the number in the jah_pending cookie, and a count of tries. The link and the code work once, for 15 minutes, and the code stops after five tries. | Deleted within a day of expiry |
| Session records | A hash of your session token and its dates. A session lasts at most 90 days. | Deleted within a day of expiry, or about eight days after sign-out |
| Consent token | The token of your latest sign-in consent that IDT confirmed (§ 3.4). | Until you delete your account |
| Guestbook entries | What you write. It is public, with your display name, once approved. | Until you delete it or your account |
| Follows | The publications you choose to follow. | Until you unfollow or delete your account |
| Sign-in and deletion log | A record of each sign-in and each account deletion. It holds identifiers only (your account number, your workspace number and Cloudflare’s request number), never your email address or anything you wrote. | Kept permanently (§ 3.5) |
A hash is a one-way fingerprint. It hides the original value, but it is still data about you, so this page does not call it anonymous.
3.2 The cookies
The site sets two cookies, and only for signing in. Page scripts cannot read either one, both travel only over HTTPS, and other sites cannot make your browser send them with a hidden request or a form that posts data.
jah_pendingis set when you ask for a sign-in email. It holds a random number that lets the code in that email sign in this browser and no other. It ends after 15 minutes, or when this browser signs in.jah_sessionis set when you sign in. It holds a random session token and nothing else. It ends after at most 90 days, and signing out deletes it at once.
There are no other cookies, so the site shows no cookie banner.
3.3 Records of people who never finish signing in
The site writes a sign-in link record when you ask for a link, and makes an account only when you use it. If you ask for a link and never click it, your email address stays in that record until the daily cleanup deletes it, within a day of the link’s expiry. You do not need to ask.
3.4 Proof of consent (IDT)
Each time you ask for a sign-in link, the form asks you to agree to the Terms. To keep proof of that agreement, the sign-in page uses IDT, a service that the same operator runs at idt.jesseahawkins.com. IDT is not a third party. IDT starts its record when the sign-in page opens, before you type or tick anything, because the record must show what the page showed you.
| IDT records | IDT does not record |
|---|---|
| The page address, the address you came from, your IP address and your browser’s user agent | What you type in any field |
| Which fields got focus, how long each entry was, how many keys you pressed and whether you pasted | Which keys you pressed |
| Whether you ticked the box, which buttons or links you clicked, how far you scrolled, and whether the tab was hidden | Anything on any other page |
| The consent text as the page showed it, and whether it was in view | Your email address in clear text |
| A snapshot of the form’s layout and the site’s own text, without anything you typed | |
| At submit, a one-way hash of the email address you gave |
At submit, IDT seals the record with a hash chain and a digital signature, so a later change to it shows. If you leave the page without asking for a link, IDT seals what it has 30 minutes later. When you use the sign-in link, the page with the Sign in button also states that signing in means you agree to the Terms. The site then asks IDT to confirm that the record is real, that this site’s form sealed it for this request and for your email address, and that it shows the current consent text. If IDT confirms it, the site keeps the record’s token with your account in place of the one before.
Why. To prove that the person who asked for each sign-in link agreed to the Terms, and to protect the sign-in form from abuse.
How long. IDT deletes each record 90 days after the seal, whether or not you asked for a link. Once a day, IDT publishes one combined hash of all records sealed that day to the public OpenTimestamps servers, so that nobody can change the date of a record later. That combined hash shows nothing about you or about any one record.
3.5 Deleting your account
Your account page deletes your account. The deletion removes your account and everything linked to it: sessions, guestbook entries, comments, follows, your workspace record and your sign-in link records. Two things stay. The sign-in and deletion log stays, because a log that can be changed is not a log, and it holds identifiers only, which no longer point to a person. IDT records stay until their 90 days end. Cloudflare’s backups can keep data for a time under Cloudflare’s own schedule.
4. What you post in public
Guestbook entries are public. Anyone can see them, with your display name, and search engines can index and archive them. Treat what you post as public for good, even if you delete it here later.
Before an entry is published, a content-safety model that runs on Cloudflare (@cf/meta/llama-guard-3-8b) checks its text. If the check fails or cannot run, the entry waits for the site owner to review it. No text you post goes to Anthropic, OpenAI, Google or any similar company.
5. The Lab tools
The tools in the Lab send your search to third-party data services and show what they return. The site records each use of a tool: which tool, a short summary of what you typed, and a short summary of the result. These records hold no account number, so they are not linked to you, and the daily cleanup deletes them after 90 days.
6. Bot protection and rate limits
The sign-in and guestbook forms use Cloudflare Turnstile, which checks that your browser is a browser and not a script. Those two pages load a script from challenges.cloudflare.com, and Turnstile receives your IP address and technical signals from your browser. Cloudflare says that it does not use this data to track you across sites or for advertising. No other page loads Turnstile.
To stop people using the sign-in form to send unwanted email, the site counts sign-in requests from each IP address, and to stop people guessing codes, it counts code tries from each network. It keeps your IP address as a counter for five minutes after your last request or try, and then the counter ends. The site does not store it with your account.
7. Who else receives data
| Who | What | When |
|---|---|---|
| Cloudflare | Hosting, database, email delivery, bot protection and content checks | Every request |
| Scryfall, pokemontcg.io, YGOPRODeck, CardSight | The search you typed | Only if you use the collectibles tool in the Lab |
| OpenTimestamps servers | One combined hash a day, which shows nothing about you | Daily |
That is the full list. The site sells nothing about you and shares nothing for marketing. It sends no marketing email: the only email it sends is your sign-in email.
8. Tracking and Do Not Track
This site does not track you across other sites, and it lets no third party do so. Turnstile is the only third-party script, and it runs only on the two forms in § 6. Because the site does no cross-site tracking, it does nothing different when your browser sends a Do Not Track or Global Privacy Control signal.
9. Your rights
Wherever you live, you can see, correct, copy or delete the data the site holds about you. Your account page shows your email address and deletes your account. For anything else, email [email protected], and you do not need to name a law to ask.
If you are in the European Economic Area or the United Kingdom. The site uses your email address, account data and posts to provide the account you asked for (Article 6(1)(b) GDPR). It uses the IDT record, Turnstile, the rate-limit counter and the sign-in log for its legitimate interest in security and in proof of consent (Article 6(1)(f)). You need an email address to make an account. The site makes no automated decision about you that has a legal or similarly significant effect. Your data is processed in the United States. You also have the right to restrict or object to processing, and to complain to your data protection authority (in the United Kingdom, the Information Commissioner’s Office).
10. Security
The site stores sign-in tokens and session tokens only as hashes, so a copy of the database does not let anyone sign in as you, and all traffic is encrypted in transit. The database is not encrypted with a key that the site owner holds. Cloudflare’s platform security protects it, and anyone with access to the Cloudflare account can read it.
11. Children
This site is not for children. You must be 16 or older to make an account. If the site learns that an account belongs to someone under 16, it deletes the account. If you think a child has given the site personal data, email the address in § 1.
12. Changes
When this page changes, the date at the top changes. Each sign-in asks you to agree to the current Terms and points you to this page, so a material change reaches you at your next sign-in.