Privacy

There is no sign in, no form that submits anywhere, no cookie, no analytics script, no advertising and no third party asset of any kind. The site is a set of static files. Reading it leaves nothing behind on our side that is tied to you.

One thing, and only when you ask for it. Choosing light or dark at the foot of the page writes a single entry called traceary-theme into your browser’s local storage, holding the word light or dark. Setting the theme back to system deletes it. It is read once when a page opens so the theme does not flash, and it is never sent anywhere.

No cookie is set. The live site answers without a Set-Cookie header at all, which is something you can check yourself from a terminal rather than take on trust.

Everything a page needs comes from traceary.com. Fonts are served from here rather than fetched from a font host, so opening a page tells Google nothing. The collected release notes have their images stripped on the way in, so no page carries an image from anywhere, which also means no tracking pixel can ride in on someone else’s notes.

This is enforced rather than promised. Every response carries a content security policy that allows scripts, styles, fonts, images and connections from this origin only, and the policy is written in public/_headers in the repository. A third party asset would be blocked by your browser, not merely absent by intention.

The product finder on the home page and the filter on the catalog both work on a list that is already inside the page you downloaded. Nothing you type is sent anywhere, logged, or completed by a service. No client side code on this site makes a network request at all.

The site is hosted on Cloudflare Pages, and delivering a page means a connection is made. Cloudflare processes that connection the way any host does, which includes your address, the page you asked for, the time and your browser’s user agent, and it uses it to serve the file and to absorb abuse. Cloudflare publishes its own account of how it handles that.

Traceary adds no measurement on top of it. There is no analytics product enabled, no visitor profile, no log we keep ourselves and no record anywhere that is tied to a reader.

One detail worth being exact about: Cloudflare attaches its own network error reporting header at the edge, so a browser that fails to reach the site can send a report about that failed connection to Cloudflare. It reports connection failures rather than reading, it goes to the host rather than to us, and it is not something Traceary receives or asked for.

Release pages link back to their publisher, and the notes carry whatever links their authors wrote. Following one puts you on someone else’s site under their handling of data. Traceary sends a referrer policy that passes only the origin, so the publisher learns that you came from traceary.com and not which page you were reading.

Mail sent to [email protected] is kept only as long as it takes to deal with, and it is not added to any list. There is no newsletter to be subscribed to. Ask and your message is deleted.

Since there is no account and no record tied to a reader, there is nothing held here to export or erase apart from a message you sent yourself.

Adding anything that measures readers would make most of this page false, so this page is the first thing that gets rewritten and it is rewritten before the change ships. Traceary’s own changelog records changes of that size, and the terms of use and the imprint cover the rest.