What is a Privacy Policy?

Let’s be honest: if you’re on the internet in 2023 and are not aware of what a mess online privacy in the digital world is, then what kind of a rock have you been living under? Anyhow, “Privacy Policies” come in 3 flavours, in descending level of cost: 1) Big Tech Privacy Policies that are up to the date current with all of the latest legal knowledge that protects the firm and not at all you; 2) Small and Medium Enterprise Privacy Policies written by a lawyer where the client wants minimal bills but some protection, so they are mostly just whatever precedent language is standard with some tweaks (thank you, Practical Law); and 3) The stuff that’s written by the small business or individual that is almost entirely wrong and kludges together bits and pieces from other websites and/or uses whatever text came with the hosting.

This policy is type 3 since I wrote it myself based on the WordPress precedent language that came with the hosting.

I try not to collect any of your personal information, but I’m not a professional and I’m running this thing myself as a hobby. It’s mainly got the WordPress defaults, so whatever they collect is what is being collected and whatever they track is what’s being tracked. There might be some analytics running, but it should be anonymized. If I’m collecting more than that, I don’t know about it and if I did I’d stop it.

Who we are

So this is my personal blog. My website address is https://secretspaceman.com.


Look, obviously when you leave comments on the site then anything that you enter into the comment form is being collected. Also, your IP address and browser user agent string are collected. WordPress says that’s to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Whenever you visit anyone on the internet, at a minimum you are giving them your IP address, so that should not be a surprise to you. If you don’t give them your IP address, it gets pretty tough for them to send you any data back Just FYI.


Okay, so here’s one that might not be obvious. A lot of media files contain meta data that can tell people a lot of stuff that you might not want them to know. For example, in my first year of practice as a lawyer, I was working on a commercial leasing dispute and the plaintiff sent this “Bombshell” photo that “Proved” something that was supposed to have happened before some event. Except that the meta data in the photo showed it was taken well after that event. She didn’t know the photo had the meta data. That file was a gong show. The plaintiff was so untrustworthy.

Anyhow, all of that is to say that if you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Ultimately, your privacy is as much your responsibility as anyone else’s. We can try our best to protect and limit the information that you provide us, but this policy is just a policy. It’s questionable as to whether or not it’s a binding contract (it’s just a browse-wrap after all). Best I can do is try to be honest about what we’re doing over here.

To the best of my knowledge, I’m not selling your data, okay?


Good lord, cookies. We’re still using these? Yeesh.

Okay, so cookies are these little files that websites store on your computer that contain information about you. These are useful for web applications because stored information is really important for doing things like remembering who you are and remembering that you wanted to order a pencil or whatever. About 20 years ago they were pretty great. Now I think they mainly get used for advertising and tracking behavior. Anyhow, apparently WordPress still uses them.

So, if you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Oh, man, ya, welcome to the internet. So one of the reasons that the internet is so great is that it’s a seamless way of linking a lot of different things together. It’s not always obvious when you’re on one website or another that you’re actually seeing content from another site. That’s called embedding. Because this is a blog, I might embed articles, videos, images, tweets or whatever. Those embeds actually contain bits of third party websites that I don’t control. Take it away, WordPress:

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

I don’t plan on letting people set up accounts, but if you did and if you request a password reset, your IP address will be included in the reset email.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue. Also, that should have been obvious

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information. Again, this should all be obvious.

Where your data is sent

Visitor comments may be checked through an automated spam detection service. Otherwise they’re stored in the “cloud”, which probably just means a data centre that is run by my ISP (or more likely some third party under contract) in some random spot In the world. I hope it’s the US or Canada, but I don’t know. After all, we call it the cloud because we all stopped caring at a certain point. Basically, don’t send me personal data, okay?