Privacy & Security
This page is maintained by the site owner to answer common security and privacy questions. It describes current practices and is not an independent certification.
What we collect
- Contact form submissions: your name, email, subject, and message — used solely to reply to your enquiry.
- Aggregate visit analytics: page path and approximate country, recorded server-side. No cookies, no cross-site tracking, no advertising identifiers.
How we store it
- Data is stored in a managed Postgres database with Row-Level Security enabled on every table.
- Only authenticated administrators can read contact messages or visit analytics. Public visitors cannot read either.
- Analytics rows are written only by trusted server code, never directly from the browser.
- Images and media live in a private storage bucket and are served through short-lived signed URLs.
Access control
- Administrator accounts are gated by a server-side role check. Client-side role data is never trusted.
- Only the first registered account becomes an administrator; further admins must be invited from inside the admin dashboard.
- Sign-in uses email + password over HTTPS.
Your choices
- You can request deletion of any contact message you submitted by writing to us via the contact form.
- To report a security concern, please use the contact form and mark the subject as "Security".