Privacy policy

What is collected

• The contact form: your name, email address, organization, what it is about, and whatever you write in the message.
• The short enquiry form on the service pages: your email address, your website if you give one, and your message.
• The Project check: the answers you pick, your website address if you give one, and anything you write in the last box. Depending on the service, the questions include how big your organization is, a budget range, or a monthly ad spend — I ask because the answer changes what I would tell you.
• Nothing from the Project check reaches me until you enter an email address and press send. The take you see is worked out in your own browser — while you are answering, none of your answers leave it. You can watch that in the network tab for those answers. If you do send it, your answers go with it, because they are the brief.
• The hidden fields, in full. Each form carries its own name, so the host knows which one was submitted. The service-page form also records which service you were reading about, and the Project check records which of its entry points you started from. The Project check also attaches your own answers written out in words, because the raw ones arrive as codes and I would rather read a brief than decode one — it holds nothing you did not choose, type, or already see on screen. There is also a decoy field, hidden from you and from screen readers, which exists to catch automated submissions; the host discards that field before your message is stored, and a real submission arrives with it empty. That is the whole list.
• Server logs: the hosting provider records standard request data, including IP addresses, for security and reliability. I do not use it to build any profile of you.
• Tag Manager loads so your choice can be applied. Google Tag Manager is requested so consent can be set before any analytics measurement runs. That means a request to Google’s tag servers can appear in your network tab even if you have not allowed analytics yet.
• Analytics measurement — only if you agree. If you accept the cookie notice, Google Analytics runs through Tag Manager: it may set cookies and record the pages you visit, roughly where you are (city level), and what kind of device and browser you used.
• If you decline, or ignore the notice, analytics cookies and page measurement do not run. Tag Manager may still have loaded; Google Analytics is told storage is denied and should not measure you. This site does not use the “advanced” mode that sends cookieless pings when you say no.
• No advertising trackers, and nothing that follows you to other sites.

Your choice is stored in your browser's local storage under kd-consent. It is not a cookie, it is not sent to me, and it is only there so you are not asked on every page.

If you use the Project check, your answers are held in your browser's session storage under kd-project-check, so that reloading the page does not lose what you have already answered. Not a cookie, and gone when you close the tab — a draft of what you would send, held on your machine until you send it.

Why I want analytics at all

To find out which pages are actually useful and which ones nobody reads, so I write more of the former. That is the whole reason. I am not building an audience profile, I am not retargeting you, and there is no advertising pixel on this site.

Google Analytics is a Google product, and accepting means Google processes that measurement data under their terms. If you would rather they did not, decline — the site works identically either way, and nothing is withheld from you for saying no.

Your analytics setting

Change it here, as often as you like. It takes effect immediately — you do not have to reload the page, and nothing about this choice is sent to me.

What it is used for

• To reply to you, and to carry on the conversation you started.
• That is it. Your details are never sold, rented or shared for anyone else's marketing.
• One automatic confirmation, and that is all. Whichever form you use, you get a single email back showing what arrived and when to expect an answer. It repeats your own answers, never anything I worked out about you, and it leaves out whatever you typed in a free-text box — because email is not a private channel and an address can be mistyped. There is no second automatic message. The next one you get is one I wrote.
• Sending the form does not subscribe you to anything. Under Canada's anti-spam legislation I will not add you to a mailing list without asking you first, and any such message would carry an unsubscribe link that works.

Where it goes

The site is hosted by Netlify and form submissions are processed by them before reaching my email. Email is handled by Zoho Mail, and ZeptoMail — Zoho's mail-sending service — delivers a readable copy to my inbox and sends you the one confirmation described above. If you accept analytics, Google processes that data too. All are outside Canada, which means your message may be stored on servers in other countries and can be subject to the laws there. If that is a problem for your organization, email me directly instead of using the form, or ask and we will arrange another route.

How long it is kept, and your rights

• Enquiries that do not become work are deleted after two years.
• Records connected to actual engagements are kept for seven years. Canadian tax rules require six; I keep the extra year so nothing is deleted early.
• You can ask what I hold about you, ask for it to be corrected, or ask for it to be deleted. Email me and I will do it within 30 days.
• If you are unhappy with how I have handled your information you can complain to the Office of the Privacy Commissioner of Canada.

Client data during a project

Project work often means access to your systems, your analytics and sometimes your customers' data. That is governed by our engagement agreement, not by this page: I take the least access that does the job, hand credentials back or have them revoked at the end, and I do not move your data anywhere it was not already going. Public-sector and healthcare clients with specific privacy obligations — ask, and we will write them into the agreement.

Contact

Privacy questions or requests: m@koval.dev. Mike Koval, Thunder Bay, Ontario, Canada.

Last updated September 11, 2026. If this site starts using anything else — a mailing list, a chat widget, an advertising pixel — this page is updated before that happens, not after.