Privacy

You’re reading a privacy policy. Voluntarily. Something has gone wrong in your life and I’m delighted to be part of it.

Here’s the short version. I count page views. I use one optional cookie to spot repeat visits, and one essential cookie to remember whether you wanted the first one. No recordings, and nobody stores your IP address in the analytics. Private CV links have separate visit records, described below. If you subscribe to the newsletter, that email address sits in a database only the newsletter code can read, with no link to anything you looked at.

The long version is below, because UK GDPR insists. The cookie is yours to switch off at the bottom of this page.

Who I am

I’m Will Hackett. I run this site on my own. There’s no company behind it, no analytics team, and no growth department. Just me, a domain name, and an unreasonable interest in what people click on.

For privacy questions or requests, email gdpr@willhackett.com. It comes straight to me. For anything else, I’m on LinkedIn.

I only want to know which posts land

There are no ads on this site, no affiliate links, and no pixels working for anyone else. I write things and I’m curious whether they work.

To prove how mundane this is, here are the results. Agentic coding workforce is my most-read post this year. Just use Postgres is second. My least-read post is a 404, because I deleted it. It was a pre-relationship agreement written as a comedy sketch about how grim internet dating had become, from 2014, back when I had no filter. It is still floating around the web somewhere if you’re determined enough.

Nobody pays me for any of that data. I just like knowing.

One disclosure, because a privacy policy that oversells its own purity isn’t worth reading. I co-founded a company called flowstate, and I write about it here fairly often. Some of these posts are, in the honest sense of the word, an advert.

What that doesn’t change: nobody at flowstate has access to this site’s analytics, and no reader has ever been handed over as a lead. Knowing which posts land does make me better at writing about my own company. That’s a motive, and now you know about it.

Private résumé links

If I send you a private link to my CV, that link has a recipient label. I record when it is requested, when it is displayed in a visible browser tab, the country reported by Cloudflare, and whether the request looks automated. This lets me see whether the link I sent has been opened. A forwarded link keeps its original label, so it does not prove who read it.

These records sit separately in Cloudflare D1. The CV page does not use PostHog, cookies or a fingerprint, and its visit records do not contain your IP address or browser details. The access key is removed from the address bar after the page loads. Cloudflare also handles the request and may retain the original URL in its service logs. Email gdpr@willhackett.com to ask me to delete a private-link record.

What I collect

When you read a page, the analytics records:

• the page you looked at and its title
• the site or search engine that sent you
• your rough country, browser, operating system and screen size
• when you left the page, so I can tell a glance from a read
• a random ID from the visitor cookie, if you said yes to it

All of it as counts. The analytics is PostHog, on its EU servers, switched down to the bare minimum: no automatic click capture, no session recordings, no profiles, and nothing of its own written to your browser. Without the cookie, the random ID it uses to group one visit lives in the page’s memory and dies when you close the tab, so it can tell me 300 people read a post today but not whether any of them had read something else of mine last month. The cookie is what changes that, and it is the one thing I ask before doing.

If you subscribe to the newsletter, I collect your email address. Nothing else. Not your name, not your blood type, not your mother’s maiden name.

The cookie

One cookie, called visitor. It holds a random ID that looks like 0f9c1a2b-3d4e-4f50-8a6b-7c8d9e0f1a2b. It means nothing on its own and it isn’t derived from anything about you. Your browser invents it.

Its only job is to turn “300 people read this” into “300 people read this, and 40 of them had read something else of mine first”. That is the entire feature. It never becomes a profile: PostHog is told to treat it as anonymous and never build one.

The banner calls it wafer-thin. That’s the only Monty Python reference in this document, and if you know the sketch you’ll understand why I stopped at one.

There’s a second cookie, visitor-consent, which remembers your answer so I only ask once. Yes, I need a cookie to remember that you didn’t want a cookie. I didn’t design this system and I’m as delighted by it as you are.

Both are set on willhackett.com with no domain attribute, so they’re never sent to any subdomain. Neither is shared with anyone.

Ignore the prompt for 30 seconds and it answers no for you, then says so. Silence should never count as a yes.

Cookie banners belong in the browser

If your browser sends Do Not Track or Global Privacy Control, you get no prompt and no cookie at all. Neither signal legally binds me in the UK, and the Do Not Track standard was abandoned in 2018, but both are a clear enough no that arguing would be rude.

Years ago I put it to the EU that this whole problem could be solved by moving consent into the browser, where it plainly belongs. I’d like to report that this went well.

The ePrivacy Regulation was proposed in 2017. The Commission announced it was giving up in February 2025, on the basis that nobody expected the co-legislators to ever agree, and the formal withdrawal was published that October. California then passed a single bill, and from January 2027 any browser serving Californians has to offer the setting anyway. Eight years of negotiation, outpaced by one state legislature and a checkbox.

Things I don’t do, and can’t be bothered to start

• Store your IP address. It obviously passes through Cloudflare, because otherwise the page couldn’t reach you, and PostHog sees it in passing to work out a rough country. Neither writes it down against anything of yours.
• Hand you to an ad network. No Google, no Meta, no data brokers. PostHog is an analytics company, and it holds the counts as my processor, nothing more.
• Link the newsletter to the analytics. Subscribing fires no analytics event, and the analytics has no identifier the list could be joined on. I won’t claim it’s impossible to build, because it isn’t. I’d have to do it in your browser though, and you would see it in the network tab within seconds. This site can’t betray you quietly, which is the only guarantee worth much.
• Follow you anywhere else. The cookie is useless on any other website, and I have no way to see what you do off this one.

Check all of that yourself

Don’t take my word for it. Open DevTools and look. This is the only privacy claim on the internet you can audit in about 90 seconds.

• Application, then Cookies. You’ll find visitor and visitor-consent if you said yes, and nothing else of mine.
• Network, filtered to t.willhackett.com. That’s the analytics: a hostname of mine that hands the request to PostHog, so it keeps working behind blockers that cut off posthog.com by name. One request per page and one when you leave it. Read the payload. It’s the page URL and title, the referrer, a screen size, a browser, and a random ID. If you said yes to the cookie it is that ID; otherwise it changes every time you open the site. There is no cookie header on the request either way: the ID is read by JavaScript and put in the body, which is how it stays scoped to this domain.
• Then the newsletter form. It posts to newsletter.willhackett.com, and only when you press the button.

The lawful basis, for the lawyers

Counting page views doesn’t identify anyone, so it relies on the statistical purposes exception that PECR gained on 5 February 2026. The ICO’s guidance on it is clear that the exception “is not for identifying, tracking or monitoring people”, so the counting needs no consent and the cookie does.

The visitor ID is different. A random string that persists across visits counts as personal data under UK GDPR even though I have no idea who you are, and storing it needs permission first under PECR regulation 6. So it rests on your consent, under UK GDPR Article 6(1)(a).

I show the prompt in the UK and the EEA, where asking first is the law. Elsewhere the cookie is set without one, and there the basis is my legitimate interest in knowing whether anyone comes back, which is about as mild as a legitimate interest gets. Either way the switch below turns it off, and a refusal sticks.

One thing I’d rather say than have you find: the page address the analytics records can include anything after the question mark. Most of the time that’s nothing. Sometimes I send a person a link with a parameter on it, and for those I can tell that particular link got opened. It isn’t a general capability and I don’t use it to build a picture of anyone, but it means I shouldn’t claim every URL in those counts is anonymous.

Newsletter subscriptions rest on your consent under UK GDPR Article 6(1)(a), plus PECR. You give it by typing your email and clicking the confirmation link. Classic double opt-in.

There ought to be a carve-out for this. Nothing elaborate. Something along the lines of: if your website carries no advertising, no third parties and nothing whatsoever to sell, you may write down what you collect and then get on with your life. There isn’t one. The regime that governs an ad network with a legal department also governs me, alone, working out whether a random number in your browser justifies a page of statute.

It does, apparently. So here we are, citing regulation 6 at each other. All of it applied in good faith by a man whose least-read post is a comedy pre-nuptial agreement he had to delete.

Who else touches your data

Cloudflare serves the site, sends the newsletter and hosts the database the subscriber list sits in, under its standard data processing terms. The database is placed in Western Europe. Cloudflare is a US company, and like every such platform it keeps its own account, support and operational records wherever it keeps them. I don’t own the metal. I do own the software, the list, and every row in it.

PostHog holds the page view counts, on its EU Cloud in Frankfurt, as my processor under its data processing agreement. PostHog is also a US company; the event data stays in the EU, its account and billing records don’t. The counts going back to February 2025 were moved there from the self-hosted tool I ran before, so the history is in one place.

Those two are the lot. An earlier version of this page named Resend, Bunny, Vercel and Neon here. They’re gone.

How long I keep it

• visitor expires 12 months after your last visit, or the second you press the switch below.
• visitor-consent lasts 12 months for a yes and six months for a no, so a refusal is respected without me forgetting it a week later.
• Page view events stay in PostHog for its retention period. Without the cookie there is nothing per person in them to expire.
• Your email address stays until you unsubscribe. Then the row is deleted, straight away.
• An address that never confirms is deleted after 48 hours.
• If mail to you bounces, your address goes on a suppression list that Cloudflare keeps for my sending domain, so I don’t keep bouncing off you. I can see and clear that list.
• Being straight about backups: Cloudflare keeps a 30-day point-in-time history of the database for disaster recovery. A deleted address can exist in that history for up to 30 days, and then it’s gone everywhere.

Your rights

Depending on the circumstances, UK GDPR gives you the right to ask me to:

• tell you what I hold about you
• correct it if it’s wrong
• erase it
• stop or restrict what I’m doing with it
• hand it over in a portable format
• honour a withdrawal of consent, at any time, for any reason

In practice the only data I hold about anyone is a newsletter email address, so most of that list resolves to the same short answer. See below.

Withdrawing is deliberately easier than granting. The switch below takes one click, and every newsletter carries a one-click unsubscribe link.

If you think I’m handling this badly, you can report me to the Information Commissioner’s Office at ico.org.uk. They will take you more seriously than you might expect.

Making me delete it

Email gdpr@willhackett.com. You’ll get an automatic reply, because the answer is almost always one of two things.

If you subscribe to the newsletter, click Unsubscribe at the bottom of any email I’ve sent you. Your address is deleted from my list straight away. On my side nothing is kept behind it, no record that you were ever there, apart from the 30-day recovery history described above.

For the cookie, press the switch at the bottom of this page. That deletes it, and from then on your visits get a throwaway ID again. The page views already recorded against the old ID stay in PostHog as counts until its retention runs out; I have no profile to delete, because none was ever made, and the ID points at nothing but itself.

Your tracking state

Last updated: 28 October 2026.