Alfie Nash

Legal

Privacy policy

This site collects as little as it can get away with. There are no advertising trackers, no third-party analytics cookies, and nothing is sold or shared for marketing.

Last updated .

Who is responsible

This site is run by Alfie Nash, who is the data controller for everything described below. Privacy questions and requests go to coming@soon.com.

Visiting the site

Reading pages requires no account and sets no cookies. Each page view records a small, deliberately anonymous entry:

  • the path you visited, such as /writing/some-post;
  • the hostname of the site that linked you here, if any — never the full referring URL;
  • a coarse device class: desktop, mobile, tablet or bot;
  • a visitor hash, used to tell one person from two. It is a salted SHA-256 of your IP address and browser user-agent string that is re-salted every day, so it cannot be reversed, cannot be linked to you, and cannot connect today’s visit to tomorrow’s.

Your IP address and user-agent string are used to compute that hash and are then discarded. Neither is written to the database. There is no cookie involved, so nothing follows you to another site.

These entries are kept for around 400 days and then deleted, so that year-on-year comparisons are possible without keeping records indefinitely.

Accounts

You only need an account to leave a comment. Creating one stores your email address, an encrypted (hashed) password, and the display name you choose.

  • Your display name is public. It appears beside every comment you write, including ones you wrote before changing it.
  • Your email address is never published. It is used to sign you in, to send sign-in links, and for nothing else. There is no newsletter and no marketing email.

An account confers nothing beyond commenting — it grants no access to unpublished drafts, site settings, or anyone else’s information.

Comments

Comments are public. Anyone who can read the post can read them, and they are stored with your display name and the time you posted. They are published immediately rather than being reviewed first.

You can edit or delete your own comments at any time from your account. Deleting one removes it permanently.

Comments may be hidden if they are abusive, spam, or otherwise unwelcome. A hidden comment disappears from the post but stays visible to you on your account page, marked as hidden, so you are not left guessing — and you can still delete it yourself.

Cookies and local storage

There are exactly two kinds, and neither is used for tracking:

  • Session cookies, set only once you sign in. They keep you signed in and are removed when you sign out. A signed-out visitor is sent no cookies at all.
  • A theme preference, stored in your browser’s local storage so the site remembers whether you chose light or dark. It never leaves your device and is not sent to the server.

Because nothing here is used for advertising or profiling, there is no consent banner to dismiss.

The repositories page

The repositories page mirrors public activity from GitHub. That information is fetched by this site’s server on a timer, not by your browser, so visiting the page sends nothing about you to GitHub and sets no GitHub cookies. Only public repositories are ever requested or shown.

Who else can see this

Data is processed by a small number of infrastructure providers acting on the site owner’s instructions:

  • Supabase — hosts the database and handles account authentication.
  • Vercel — hosts and serves the site, and provides aggregate performance measurements which contain no personal data.

Nothing is sold, rented, or shared for advertising.

Your rights

Under UK and EU data protection law you can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Most of that you can do yourself:

  • change your display name, or delete individual comments, from your account;
  • to delete your account and everything attached to it, ask coming@soon.com. Deleting an account also deletes its comments.

Analytics entries cannot be traced back to an individual by design, which means they also cannot be located and removed on request — there is nothing linking them to you.

If you are unhappy with how a request was handled, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this policy changes in a way that affects what is collected or why, the date at the top will change with it.