Privacy by design
No banner.
No tracking.
Every site built on our new system starts with nothing to declare: no advertising cookies, no trackers, no tracking consent banner. Analytics that count without identifying anyone, maps that load without Google, forms protected without a puzzle, fonts served from our own domain. This page is built the same way, and it can prove it.
Diagrams are illustrative where marked.
01 · Counting without identifying
Analytics that never learn who you are.
We run our own instance of Umami, an open-source analytics tool, on our own server. It counts pages and visits. It sets no cookie, stores no IP address, keeps no profile, and we strip the screen size before the data even leaves your browser.
How one visit is counted
Day 101 · Your visit
From your browser to our door
Sent by your browser
- Pagecounted
- /expertise/privacy
- Referrercounted
- duckduckgo.com
- Browsercounted
- Firefox · macOS
- Devicecounted
- Desktop
- Screen sizeremoved before sending
- 1440 × 900
Seen at the door
- IP addresshashed, never stored
- 203.0.113.42
- Countryread from the address
- Canada
02 · One-way hash
At the door of our own server
Waiting for a visit
- Today
- 7fd5 da15 d917 630b…
site+address+browser+saltNo way back to the address
03 · The count
What is kept
Counted from this visit
- —
Illustrative pageviews by day: between 24 and 52 on earlier days, 12 so far today.
Send a visit and follow it from your browser to the count.
What we can see
- Pages visited
- Referrers
- Countries
- Browser and system
- Device class
- Visits over time
What we never have
- Names
- Email addresses
- Raw IP addresses
- Cross-site profiles
- Screen sizeremoved before sending
- Cookiesnone is set
The mechanism is Umami’s, run on our own server. The browser, system, device, screen and first referrer are yours, read in this tab and sent nowhere; the address, the hashes and the numbers are examples.
02 · Maps
A map that loads without Google.
A map on a site usually means Google, and Google means cookies, scripts and a request to Google before you have touched anything. We draw ours with MapLibre, an open-source engine, on open map tiles: no account, no cookie, no script from an advertising company.
Requests this map has made
0- Map tiles0
- Letters0
- Icons0
- Style0
- Tile index0
The last 60 seconds
Each square that lights up on the map is one of these requests.
Latest requests
Nothing yet. The map asks for nothing until you reach it.
Requests to Googlewhole page, so far
0| An embedded Google mapDescribed, never loaded here | This mapCounted live | ||
|---|---|---|---|
| As the page opens | Your browser contacts Google before you have touched the map. | Your browser asks an open tile host for squares of map, and only once you reach it. | |
| Code on the page | Google’s scripts load and run inside the page. | MapLibre, open source, served from our own domain. | |
| Cookies | Google sets its cookies before any click. | None. No account, no key, no advertising script. |
The tile host sees which squares you load, like any image server. It sets no cookie and runs no code here.
03 · Forms
Protected without a puzzle.
Our forms are protected by Cloudflare Turnstile, which checks that a browser is a browser without cookies, without traffic lights to click and without following you afterwards. What you write goes into our own database, through a role that can only write, and nowhere else.
The form leaves for our own server, and only there.
Can see
- Everything you write, as you write it.
- A small Cloudflare frame that runs the check, on the contact page only.
Never
- A cookie, from us or from the check.
- A puzzle to solve.
What travels here
- What you writeAlex · “A new site?” · typed
- Your emailalex@example.com · typed
- Your IP address203.0.113.24 · sent
- CookiesNone, at any station
Checks, quietly, that a browser is a browser, then hands it a token for this site and this form.
Can see
- Signals that a real browser is at work.
- The connection it comes from.
Never
- What you write: the form never passes through it.
- A cookie.
- Traffic lights, crosswalks or any other puzzle.
What travels here
- What you writenever sees it
- Your emailnever sees it
- Your IP addresssees the connection
- The check’s tokenissued
- CookiesNone, at any station
Asks Cloudflare whether the token was issued for this exact hostname and this exact action. A token made anywhere else fails.
Can see
- The form, the token, and the IP address the request comes from.
Never
- A request sent from another site: it answers its own page only.
- Anything to keep: it hands the form to one database function.
What travels here
- What you writechecks it
- Your emailchecks it
- Your IP addresschecks the token with it
- The check’s tokenverified · dropped
- CookiesNone, at any station
Runs under a role that can write a message and nothing else. It counts attempts to slow abuse, then stores the message.
Can see
- The form.
- Two keyed hashes (HMAC, with a secret): one of your email, one of your IP address. They only count attempts.
Never
- The inbox: its role can write, not read.
- Your raw IP address: it is never stored.
What travels here
- What you writestores it
- Your emailkept · its hash counts · hmac b41e…90d2
- Your IP addresshashed, then dropped · hmac 7f3a…c19e
- CookiesNone, at any station
We read it in a local application, and we write back to you.
Can see
- Your name, email and message, and the phone and business if you gave them.
Never
- A marketing tool.
- A third-party CRM.
- Your IP address.
What travels here
- What you writeread by us
- Your emailto write back
- Your IP addressnot stored
- The check’s tokennot stored
- CookiesNone, at any station
| What travels | Your browser | Cloudflare Turnstile | Our server | A database function | The inbox |
|---|---|---|---|---|---|
| What you writename, message, phone, business | Alex · “A new site?”typed | never sees it | checks it | stores it | read by us |
| Your emailto write back to you | alex@example.comtyped | never sees it | checks it | hmac b41e…90d2kept · its hash counts | to write back |
| Your IP addresssent with every request | 203.0.113.24sent | sees the connection | checks the token with it | hmac 7f3a…c19ehashed, then dropped | not stored |
| The check’s tokenproof of a real browser | issued | verified · dropped | not stored | ||
| Cookiesset by the form or the check | |||||
Your browser
Where you type
The form leaves for our own server, and only there.
Can see
- Everything you write, as you write it.
- A small Cloudflare frame that runs the check, on the contact page only.
Never
- A cookie, from us or from the check.
- A puzzle to solve.
04 · Fonts, video, embeds
Nothing loads from elsewhere until you ask.
Fonts are served from our own domain. Video plays from our own storage. A player from YouTube or Vimeo is not contacted until you choose to play it, and where the platform offers one, its privacy-enhanced mode is used.
Illustrative · a common pattern, no particular site
Move through time and watch what each page asks for, and from where.
Talked to so far
- mystya.com
- our storage
- analytics.mystya.com
Talked to so far
- example.com
- a tag service
- a fonts service
- a consent service
- a video platform
- an ad network
- a social network
A page we build
- The pagemystya.com
- Our stylesmystya.com
- Our fontsmystya.com
- Our imagesour storage
- Our analyticsanalytics.mystya.comproduction only · no cookie
- Embedded videonothing yetLoads only when you press play
A typical site with a consent banner
- The pageexample.com
- Stylesexample.com
- Tag managera tag service
- Fonts from a CDNa fonts service
- Imagesexample.com
- Consent bannera consent service
- Embedded playera video platformbefore anyone presses play
- Advertising pixelan ad network
- Social pixela social network
- From elsewhere
- 0
- Banner
- None
- From elsewhere
- 6
- Banner
- Yes
- The site’s own domain or storage
- Somewhere else
- Can set cookies
- Waits for you
05 · The law
Privacy law, without the theatre.
PIPEDA, Québec’s Law 25 and the GDPR differ in scope, but they share a practical principle: collect only what you need, explain what you collect and why, and protect it appropriately. The simplest privacy posture starts by collecting less in the first place. On a site we build, what is collected is what you send through a form, with only the details needed to handle it, and the policy says so in plain words.
Data map · a site built here
IllustrativeChoose a question. Arrow keys work too.
01 / 04
What is collected
What you send, and only the details needed to handle it.
The contact form
- NameRequired
- EmailRequired
- PhoneOptional
- BusinessOptional
- MessageRequired
Kept with it
- The language you wrote in
- The time you sent it
To stop repeat sends
Never the addresses themselves, nor the check’s token. Old hashes are cleared at the next send.
Page visits are counted by our own analytics, without a cookie and without knowing who you are. See section 02
02 / 04
Where it lives
In the studio’s own database. Not in someone else’s tool.
- Your browserSends the form over HTTPS
- The siteHosted by VercelWrite only
- The databaseNeon · where the message is kept
Every provider is named in the privacy policy. Some host in the United States, and the policy says so.
03 / 04
Who reads it
The studio, in a local application. Nobody else.
- The studioReads the inbox in a local application.Reads
- The siteCan write your message. Cannot read it back.Writes only
- Cloudflare TurnstileChecks the browser, never the message.Checks only
Never passed to
Marketing toolsThird-party CRMsData buyers
04 / 04
What you can ask
To see it, correct it or withdraw it. One email is enough.
- SeeAsk what the studio holds about you.
- CorrectHave anything inaccurate fixed.
- WithdrawTake back your consent to its use.
The person responsible for personal information reads this address.
What a site built here does not do
By design- No advertising cookiesNothing is set for an advertiser.
- No retargetingLeaving the site means leaving it.
- No social pixelsNo platform script watches the page.
- No fingerprintingNo device probing, no cross-site identifier.
- No tracking consent bannerNo non-essential tracking to consent to.
Three laws, three demands, one answer.
A summary, not legal advice.The practice
Privacy is a design decision.
It is not a banner added at the end. It is decided page by page: which script earns its place, which service touches your visitors, which default is the right one. We make those decisions in your favour, and we show our work.
What this page shows is our new system, the way we build today. Sites we delivered before it may not include it.
Want a site with nothing to declare?
Tell us what you have today. We will tell you what it loads.