Last updated: July 22, 2026
1. Our commitment, in one paragraph
We built this website so that it has almost nothing to protect — because it collects almost nothing. There are no cookies, no analytics, no advertising technology, and no visitor profiles. Every asset is served from our own domain. The only personal data that ever exists here is a message you choose to send us, and you can have it deleted with a single email. Security is not a feature we bolted on; it is the shape of the site.
2. Zero tracking — the checkable list
Any developer can verify these claims with their browser's developer tools (Network and Application tabs). On this website there are:
- 0 cookies — first-party or third-party. Check the Application → Cookies panel: it is empty.
- 0 analytics scripts — no Google Analytics, Tag Manager, Meta Pixel, Hotjar, session replay, or telemetry beacons of any kind.
- 0 advertising or social embeds — no ad networks, retargeters, like buttons, or share widgets.
- 0 third-party requests — fonts, images, video, CSS, and JavaScript all load from this domain. Our typefaces (Baloo 2 and Nunito) are self-hosted specifically so your browser never contacts a font service (see Licenses).
- 0 fingerprinting — no scripts probing your device, canvas, or fonts to build an identifier.
- 0 localStorage identifiers — the site stores nothing in your browser between visits.
This is also why there is no cookie banner: consent pop-ups exist to legitimize tracking. We removed the tracking instead of the pop-up.
3. What technically happens when you visit
When you open a page here: your browser makes an encrypted HTTPS connection (TLS 1.2 or newer) to Amazon CloudFront, the content-delivery network in front of our site; CloudFront fetches the page from a private Amazon S3 storage bucket that cannot be accessed directly from the internet (it answers only to our CDN via AWS's Origin Access Control); and the page is delivered to you, often from an edge server near you. Plain HTTP is never served — it is permanently redirected to HTTPS, and HTTP Strict Transport Security (HSTS) tells your browser to skip insecure connections entirely in the future.
We keep CDN access logging switched off: we do not accumulate logs of who visited which page. Amazon's infrastructure transiently processes standard connection data (like your IP address) to route and secure requests — that is inherent to how the internet works and is governed by AWS's own commitments. Our own monitoring sees only anonymous aggregate counts, such as how many requests errored in an hour.
4. What technically happens when you use the contact form
The contact form is the one place data flows from you to us. Its pipeline, end to end:
- Your message travels over TLS to our own form endpoint (hosted on Amazon API Gateway + AWS Lambda — our code, our account, nobody else's service).
- Every field is validated and length-limited; malformed submissions are rejected.
- A hidden honeypot field traps spam robots: if it is filled, the submission is discarded without processing.
- Rate limiting caps how fast the endpoint accepts submissions, blunting abuse and flooding.
- Valid messages are delivered as email to bryan@tdangrycubes.com with your address set as the reply address. Delivery uses SPF, DKIM, and DMARC email authentication.
- The form service is configured to never write your message contents or email address into its logs. If something fails, the log line says only that a failure happened — not what or who it involved.
- The browser side is locked too: our security policy only permits the form to talk to our own endpoint, and the endpoint only accepts requests originating from this website.
5. Security architecture of the site itself
Defenses currently active on every page:
- HTTPS-only with modern TLS (1.2 minimum) and HSTS so browsers refuse downgraded connections.
- Content-Security-Policy — the browser is instructed to load scripts, styles, media, and fonts only from approved sources (essentially: this site itself), which blunts entire classes of injection attacks.
- Clickjacking protection — the site refuses to be embedded in frames on other sites (frame-ancestors none / X-Frame-Options DENY).
- X-Content-Type-Options: nosniff — browsers must respect declared file types instead of guessing.
- Referrer-Policy — if you click away, other sites receive at most our domain name, never your full browsing path here.
- Permissions-Policy — the site tells browsers it will never request your camera, microphone, or location, so those capabilities are switched off outright.
- Private origin — the storage behind the CDN blocks all public access; there is no bucket to browse and no directory listing anywhere.
- Least privilege everywhere — each backend component holds only the narrowest permission it needs (the form sender can only send our mail; the mail forwarder can only read the inbox it forwards).
- No third-party scripts — the largest source of website compromises (injected or hijacked third-party code) simply does not exist here.
6. Email security
Mail from tdangrycubes.com is authenticated with SPF and DKIM, and protected by a DMARC policy, the trio of standards that let receiving mail systems verify a message genuinely came from us and was not altered. Incoming mail to our public address is accepted only for that specific address, stored in private encrypted storage, and forwarded to a monitored inbox. Our mail systems are configured never to act as an open relay.
7. Deleting your data — the actual process
If you have ever emailed us or used the contact form and want that information gone:
- Email bryan@tdangrycubes.com (subject "Privacy Request" helps). Tell us the address or name you used.
- We delete your messages from our mailbox and stored mail archive — verified requests are completed within 30 days, usually much faster, and we confirm when done.
- There is nothing else to delete: no account, no profile, no analytics trail, no advertising record. One inbox is the entire footprint.
Full details of your rights are in the Privacy Policy.
8. Reporting a security concern
If you are a security researcher — or just sharp-eyed — and believe you have found a vulnerability in this website or its contact pipeline, please email bryan@tdangrycubes.com with "SECURITY" in the subject line. Tell us what you found, how to reproduce it, and how to credit you. We read these personally, we will not take legal action against good-faith research that avoids harming visitors or data, and we appreciate responsible disclosure that gives us reasonable time to fix issues before publication. We do not currently run a paid bug bounty, but we will gladly credit meaningful reports.
9. What we can't promise
Honesty requires this section: no website can promise perfect security, and neither can we. What we can promise is a small attack surface (a static site with no accounts and no database of visitors), current best-practice defenses, and a simple rule we run the whole project by — the safest data is the data you never collect. If a breach affecting personal information ever did occur, we would notify affected people promptly and describe plainly what happened.
10. Questions
Anything on this page unclear, or want more technical detail? Email bryan@tdangrycubes.com — the person who answers is the person who built it.