privacy
what gets collected, what stays private, and what i ignore on purpose.
last updated august 2026. written for humans, not for a compliance team with a word count quota.
the short version
this is a personal site. the vault behind /vault is private admin storage, not a public product. i do not sell your data. there is nothing interesting enough to sell.
vault access
the vault unlocks with a private access key known only to me. a successful unlock sets a first-party HttpOnly cookie on stormej.me so the browser can call admin endpoints. visitors never create accounts, and i do not collect google profile data for vault access.
vault files
files uploaded to the vault live in a private cloudflare r2 bucket. public reads under /files are only for objects i choose to expose (like a resume). everything else stays behind the vault cookie.
analytics
the site may use posthog for anonymous-ish product analytics (page views, basic usage). you can block it with usual tracker / cookie controls. analytics is not tied to vault file contents.
realtime
live cursors on some pages use a websocket to a cloudflare durable object. that traffic is ephemeral presence, not an identity dossier.
retention & contact
the vault cookie lasts until i sign out or it expires. if you have a privacy question, email me.