Effective Date: Tuesday, July 28th, 2026
The previous version of this page described a Ghost site with a subscriber list, comments, session cookies, and a third-party CDN serving its front-end scripts. I’ve replaced that setup with a static site, and nearly everything that version had to disclose no longer exists.
That page made a commitment: if what I collect changes, this page gets updated. This is me keeping it, in the direction I’d rather be going.
Summary
If you remember nothing else:
- There are no cookies. Not analytics cookies, not “strictly necessary” ones. None.
- There is no analytics. No page-view counting, no profiles, no third-party trackers.
- There is no database, no subscriber list, and no comments. There is nothing to sign up for.
- Your browser contacts my server and nothing else. No CDN, no font host, no embeds.
- My server keeps an access log with a truncated IP address for about 24 hours, then deletes it.
- I run the whole thing myself on my own server. Nobody sits between you and me.
1. Who I Am
North Engineer is a personal technology blog at https://north.engineer, written and operated by one person. For the purposes of data protection law, I’m the data controller.
The site is a static site — plain HTML, CSS, and a little JavaScript, generated on my own laptop from Markdown files and copied to my server. It runs on Ubuntu Server behind nginx. There is no application server, no database, and no content management system. The server reads files off a disk and sends them to you.
That architecture is the reason this page is short. Most privacy policies are long because the software behind them collects things by default. This software has nothing to disclose because there is nothing running that could collect anything.
Contact: the@north.engineer
2. What I Collect
One thing.
Server logs
Like every web server on the internet, mine writes a line to a log when your browser asks for a page. That line contains:
- A truncated version of your IP address — see below
- The time of the request
- Which page you asked for
- Your browser’s user-agent string
- The referring page, if your browser sent one
The truncation is the part worth explaining. Your full IP address is never written to disk. nginx masks it before the log line is created:
| You connect from | What gets logged |
|---|---|
An IPv4 address like 198.51.100.37 | 198.51.100.0 — the last octet is zeroed |
An IPv6 address like 2001:db8:85a3:1:2:3:4:5 | 2001:db8:85a3:: — the last 80 bits are zeroed |
What’s left identifies roughly which network you came from. It does not identify you, and it cannot be reversed to recover the original address.
These logs are deleted after about 24 hours. They rotate daily and no previous copy is kept — not compressed, not archived, not backed up. There is no historical record of site traffic anywhere, including in my own hands.
I use them for exactly what they’re for: keeping the server running and dealing with abuse. I don’t analyse them for traffic statistics and don’t feed them into any tool.
Legal basis: legitimate interest in operating and securing the server.
3. Cookies
This site sets no cookies at all.
There is no cookie banner because there is nothing to consent to. A banner here would be theater — and it’s worth saying plainly that most cookie banners exist because the site behind them decided to collect something, not because the law demanded a popup.
The site also sets no storage that identifies you. Your theme preference (light or dark) is kept in your own browser and never leaves it.
4. Third-Party Requests
There are none. This is the section that changed most.
The old Ghost setup loaded its signup portal, comments interface, and search from
cdn.jsdelivr.net, and checked gravatar.com for avatars. Every visitor’s IP address was
handed to those services as a side effect of loading a page. Removing that was the main
reason for the rebuild.
On the current site:
- Fonts are served from my server. Quartz’s default configuration loads them from Google Fonts; I’ve set it to bundle them locally instead. Google is not contacted.
- No CDN. All CSS, JavaScript, and images come from
north.engineer. - No comment system. The default option ships comments through GitHub. It’s off.
- No embeds. If I ever embed something hosted elsewhere — a video, a remote image — your browser would contact that service directly, and I’d disclose it here first.
This isn’t only a configuration choice, it’s enforced. The server sends a Content Security
Policy of default-src 'self', which instructs your browser to refuse any request to another
origin from this site. If I ever accidentally introduce a third-party asset, it will visibly
fail to load rather than quietly leaking your IP address to someone.
You’re welcome to verify this. Open your browser’s developer tools, load any page here, and
watch the network tab: every request should go to north.engineer and nowhere else.
5. What I Deliberately Don’t Do
- No Google Analytics, Plausible, Fathom, Matomo, Umami, or any other analytics package — including self-hosted ones
- No advertising, affiliate links, or sponsored content
- No newsletter, mailing list, or email delivery service
- No payment processing of any kind
- No accounts, logins, or membership tiers
- No A/B testing, session replay, heatmaps, or fingerprinting
- No social media pixels or share-button scripts
The practical consequence is that I don’t know how many people read anything here. I’d rather not know than have a dashboard that knows about you.
6. Who Else Sees Your Data
Nobody.
There is no processor, no analytics vendor, no email provider, no CDN, and no reverse proxy in front of my server. The only party that observes your visit is me, and what I observe is a truncated IP address that disappears within a day.
Your network provider and mine can see that a connection happened, as is true of any website; the contents are encrypted with TLS.
I do not sell, rent, or share information, do not use anything to train anything, and have no business model that would benefit from doing so.
If I’m ever legally compelled to disclose something — a valid subpoena, a court order — I’ll comply as required, and I’ll tell you unless I’m prohibited from doing so. It’s worth being concrete about what could actually be produced under such an order: less than a day of truncated addresses.
7. How Long Things Are Kept
| Data | Retention |
|---|---|
| nginx access and error logs (truncated IPs) | About 24 hours, then deleted |
| Anything else | Doesn’t exist |
8. Your Rights
Most privacy policies spend two thousand words restating statutes. Here’s the practical version.
Whatever jurisdiction you’re in: email me at the@north.engineer and ask me what I have about you. The honest answer is almost certainly “nothing” — there’s no record keyed to you, because there’s no identifier to key one to and nothing older than a day. Ask me to correct or delete something and I’ll do it. You don’t need to cite a regulation or use any particular form of words.
For completeness:
EEA, UK, and Switzerland. Under the GDPR and UK GDPR you have rights of access, rectification, erasure, restriction, portability, and objection, plus the right to lodge a complaint with your supervisory authority. This page serves as the notice required by Articles 13 and 14. The only legal basis I rely on is legitimate interest, for server logs, for security and operations. I rely on consent for nothing, because I ask you for nothing.
California. Under the CCPA/CPRA you have rights to know, delete, correct, and opt out of sale or sharing. The only category of personal information that touches this site is an identifier — a truncated IP address — and it is deleted within a day. I have not sold or shared personal information and have no plans to.
Do Not Track / Global Privacy Control. Both are honoured trivially: there is no tracking to turn off.
9. Children
This is a personal blog about infrastructure engineering. It isn’t directed at children, and since it collects no identifying information from anyone, it collects none from children either.
10. Security
The server runs a maintained Ubuntu LTS release with automatic security updates, a firewall
limiting inbound access to what’s needed, key-based SSH only, and TLS via Let’s Encrypt on
everything. Security headers including HSTS, a strict Content Security Policy, and
Referrer-Policy: no-referrer are set on every response.
I’m not going to claim this is unbreakable, because nobody honest claims that. What I’ll claim is that there’s remarkably little to steal: a day of truncated IP addresses. There are no passwords, no email addresses, no payment data, no behavioural history, and no database at all.
Minimising what you hold is the only security measure that can’t fail.
11. Changes to This Policy
If I turn on something new that collects or processes data, I’ll update this page before switching it on, not after, and I’ll change the Effective Date at the top. Material changes get announced in a post so the change is on the record rather than made quietly.
12. Contact
Any question about this policy, any request about your data, or any correction to something I’ve stated inaccurately:
Email: the@north.engineer
I read everything and I answer.
Last updated Tuesday, July 28th, 2026. It replaces a version of the same date that described a Ghost installation with subscribers, comments, and a third-party CDN.