Privacy · Updated November 14, 2026
What this site keeps.
A personal site with four places where you can hand it something. This page says what each one keeps, where it goes, and for how long, in plain terms.
There is no advertising here and no cross-site tracking. The one analytics tool is named below, with a switch to turn it off.
Reading the site leaves nothing behind that identifies you. The host writes the standard server logs that serving pages requires, which include your IP address, and keeps them under its own short retention. The fonts are served from this site, not from Google. Embedded videos load in the privacy mode that YouTube and Vimeo offer, which sets no cookies until you press play.
The site uses Google Analytics 4 to count visits. It records the pages you view, how you arrived, your browser and device type, and a rough location that Google derives from your IP address and then discards. It does not record who you are, and I have turned off the Google features that would tie visits to advertising profiles.
If your browser's timezone is in Europe or the United Kingdom, analytics stays off until you say yes to the one-line prompt at the bottom of the page. Everywhere else it is on unless you turn it off here, and a browser that sends the Global Privacy Control signal is treated as a no. Your answer is kept in this browser only.
Checking this browser's setting.
Ask David answers one question at a time from the library. When you ask, the text of your question is sent to a model provider through the Vercel AI Gateway. Today that is Anthropic for the answer and OpenAI to search the library for it. The question, the pieces the answer drew from, the page you asked from, and a salted one-way hash of your IP address are kept in a log for twelve months. I read the log to see what the library fails to answer.
Answers are generated by a model and can be wrong. The sources under each answer are there so you can check.
The contact form keeps your name, email, topic, and message in a private queue and sends me a copy by email, with your address as the reply-to. The access request form keeps your name, email, your reason, and which pieces you asked for. Both keep a salted hash of your IP address to enforce daily limits, and the contact form runs a bot check from the host that reads signals from your browser to tell a person from a script. Those signals are used for nothing else.
These records stay for twenty-four months and are used only to reply and to remember what was asked. Replies come from my own address, so after the first one the conversation is ordinary email.
Some of the work is shared through private links. Opening one records the time, the piece, the referring site, and your browser's user agent string against that link, so I know it reached the person it was sent to. Those records stay for twenty-four months.
- ask_sessionCookie, 30 days
A random identifier set the first time you ask a question. It applies the question limits and holds no personal data.
- ask_tokenCookie, 1 day
Set when you open a private link, so Ask David can draw on the pieces that link unlocks.
- _ga and _ga_*Cookies, 2 years
Set by Google Analytics only while analytics is on in your browser. A random client identifier so repeat visits count once, with no name or email behind it.
- Browser storageStays on your device
The depth you picked on the home page, whether you have seen the Ask rules, the playback speed of the resume reel, and your analytics choice. None of it is sent anywhere.
None of these follow you to other sites, and none is used for advertising. The analytics cookies exist only while analytics is on, and the switch above removes them. Clearing site data in your browser removes all of them.
- Vercel
Hosts the site, writes the server logs that serving pages requires, and runs the bot check on the contact form.
- Neon
Holds the database behind the library, the Ask log, messages, access requests, and private-link views.
- Resend
Delivers the email copy of each message and access request to me, and the replies to access requests.
- Google
Receives the analytics events described above while analytics is on in your browser, and keeps them for fourteen months. Google signals and advertising features are off.
- Anthropic and OpenAI, through the Vercel AI Gateway
Receive the text of an Ask David question, one to write the answer and one to search the library for it. Nothing else on the site reaches them.
Each of them processes what it receives to provide that service and nothing else. Nothing on this site is sold, shared for marketing, or used to build a profile of you. The only person with access to any of it is me, through a single admin sign-in.
Ask through the contact form and I will delete anything the site holds about you, usually within a few days. You can also ask what it holds, and the answer will be short.
This page changes when the site does. The date at the top is the last time it did.