Privacy
Three things, and that is the list.
No cookies, no analytics, no tracking, nothing loaded from anyone else. What we do hold is what you type into the form, the address you type it from, and the ordinary server logs any site on the internet produces. This page names all three.
The form
It reaches us directly.
It used to hand the message to your own mail app and nothing came here. That changed: on a machine with no mail app set up the link did nothing at all, the page said it had sent, and nobody learned that somebody had tried. So the form now posts what you wrote to this site, and only falls back to your mail app if that post cannot get through.
What you send is the three fields you filled in: your name, your email address, and your message. Nothing else is read off the page, and there is no hidden field carrying anything about you.
It arrives two ways. It is written into our host’s runtime log, which is how a message is never lost if the mail step fails, and it is sent on to ops@byscorp.com as an email. If you would rather it never touched a server here, write to that address directly and it will not.
Your IP address
Counted, for an hour, to stop floods.
The form accepts five messages an hour from one address. Enforcing that means holding your IP address in memory for that hour alongside a count. It is never written to a file, never joined to your message, and never used to work out who you are: it exists so that one script cannot bury a real message under ten thousand fake ones.
Two other checks run at the same time and neither collects anything. There is a field on the form that is hidden from people and filled in only by automated scripts, and there is a check that the form took more than a second and a half to fill in. A message that fails either is dropped without being read.
This site
It loads nothing from anyone else.
No cookies
None are set, so there is no banner to dismiss. The site keeps nothing in your browser between visits.
No analytics
No page counter, no session recording, no pixel. We do not know how many people read this.
No third parties
Every file comes from this domain, the typeface included. Nobody else sees that you were here.
Who else touches it
Two companies, named.
Vercel hosts the site and runs the code behind the form. Like any web host they keep ordinary request logs: an IP address, a time, which file was asked for. They also hold the runtime log the form writes to. We do not read the request logs and we do not connect them to anyone.
Resend delivers the form’s message to our inbox as email. They see what you wrote, because they are carrying it. If that step is switched off, the form falls back to your own mail app and Resend sees nothing.
That is the whole list. If a third company is ever added, this page changes before the thing it describes does.
How long
The email stays. The rest expires.
Your message sits in one inbox, read by the people who do the work. We keep it while the conversation is live and for as long afterwards as we would keep any other correspondence about a project. It is not added to a list, not passed on, and there is nothing to unsubscribe from.
The rate-limit count is gone an hour after your last message. The runtime log and the host’s request logs roll off on Vercel’s own schedule, which is days rather than years, and neither is something we go back to.
What you can ask for
A copy, a correction, or deletion.
Write and ask for a copy of anything we hold about you, a correction to it, or its deletion, and we will do it and tell you it is done. There is no form and no account to log into: the reply comes from a person. If you are in the UK or the EU, that is the UK GDPR and GDPR right of access, rectification and erasure, and this is how you exercise it here.
The lawful basis, in those terms, is our legitimate interest in answering people who write to us, and in keeping the form usable by stopping automated floods.