Privacy
We sell receipts for a living, so here is one for the site itself. Every line below can be checked against the source that implements it — the links go to the actual files.
Last updated 25 July 2026 · Kontour AI LLC
No account, no cookies, and nothing you type — because there is nothing to type. Three things still happen that you should know about.
Two analytics tools run in production: Umami and PostHog. They record which pages get visited, which links get clicked, and coarse technical detail like browser, operating system, and country. PostHog is configured to keep no cookies (it uses your browser's local storage), and we never attach a name or email to any of it — the code never calls identify, so events are not tied to a person. Both tools honour the "Do Not Track" setting: switch it on and neither one loads. See the configuration →
PostHog records anonymous playback of site sessions, so we can see where a page confuses people. Every input field is masked before anything is sent, so the one thing you could type here — your email address in the signup box — is never captured in a recording. Recordings are not linked to an identity.
The site's typefaces load from Google Fonts, which means Google receives your IP address and browser details when a page loads. The site is hosted on Cloudflare Pages, so Cloudflare handles the request and keeps its own standard server-side logs. Neither is something we control beyond the decision to use them.
The signup form stores exactly five things, and this is the complete list: your email address, which page you submitted it from, the time you submitted it, your browser's user-agent string, and the page that referred you. That's it — there is no hidden field and no enrichment step. It goes into a private Cloudflare key-value store that only we can read. See the code that writes it →
To stop the form being hammered, the same code counts submissions per IP address for ten minutes at a time. That counter expires on its own and is never written into your signup record.
We use the address to send occasional build updates, and to reply if you started a conversation. We do not sell it, rent it, share it with advertisers, or load it into an ad network.
We keep it until you ask us to delete it. There is no self-serve unsubscribe link yet — that is a real gap, not a policy — so for now, email [email protected] and ask, and we will delete the record and confirm. You can ask for a copy of what we hold the same way.
This is the full list. The site's security policy blocks the browser from contacting any other outside host, so it can't quietly grow — you can read the allowlist yourself. See the allowlist →
If what the site collects changes, this page changes in the same commit — the history is public, so you can see what it said before. Questions, deletions, or anything else: [email protected].