Privacy policy

This site is the portfolio of Bradley Baker, a Microsoft identity and Senior Cyber Security Engineer in the San Antonio area. I run it, decide what it collects, and answer questions about this policy (see Contact). Reading the site needs no account. The site is not meant for children under 13 and does not knowingly collect information from them.

Your name, email address, optional company, and message are stored in this site's Supabase database so I can reply, and a copy is emailed to my inbox through Resend, an email delivery service. They are not sold or passed to anyone for their own use. To have a message deleted, contact me and I will remove it.

If an address sends spam, I can add it to a blocklist. Messages from a blocked address are discarded without being stored or forwarded, and the address stays on the list until I remove it.

Signing in is optional, and its only use is the guestbook: it gives each note a real author, so nobody can post under someone else's name. You sign in with GitHub, Google, Microsoft, or LinkedIn through Supabase Auth, which creates an account record holding the basic profile that provider shares: your email address, your name, the provider's ID for your account, and a link to your profile picture if you have one. A GitHub sign-in adds your username, and a Microsoft sign-in also stores the identifiers in Microsoft's sign-in token, such as your account ID and directory ID.

Your note is stored with a display name taken from that profile, never an email address, and the number of eggs you had found. Notes appear only after I approve them. An approved note shows its display name, date, egg count, and message. Your email address, picture, and account IDs are never shown on the site. I see the same fields when I moderate notes, and I can see account records in the Supabase dashboard.

The account record exists only so a note has an author. If you sign out without leaving a note, it is deleted on the spot. If you close the tab instead, an account with no note is deleted automatically within 25 hours of your last sign-in.

If you have left a note, the record stays so you can come back and withdraw it. While signed in, Delete my data in the guestbook removes your account record and every note you wrote, approved or not, or you can ask me to do it. Supabase keeps its own short-lived service logs of sign-in events under its privacy policy.

This section covers what the site receives from your Google Account when you choose Continue with Google, and what it does with it.

What the site receives

Google sign-in requests only Google's basic sign-in scopes: openid, email, and profile. Through them, Google shares your Google account ID, your name, your email address and whether Google has verified it, and a link to your profile picture. The site does not request access to Gmail, Drive, Calendar, Contacts, or any other Google service, so it cannot read them.

How it is used

Only to run the guestbook. The account ID ties your sign-ins to one account record, and your name becomes the display name on your note, which appears once I approve it. Supabase Auth needs an email address to create the account, so the address is kept, but the site never shows it, never emails you, and never adds it to a mailing list. The picture link is stored and not displayed; notes show your initials instead. After sign-in, the site makes no calls to Google with your account, and none of this data goes to Google Analytics.

How it is stored and protected

In your account record in this site's Supabase project, a hosted Postgres database, and in a session cookie in your browser while you are signed in. The site is served only over HTTPS. Row-level security in the database lets other visitors read only the display name, date, egg count, and message of approved notes, and the key that can bypass those rules never leaves the server. Nobody else can read your account record through the site.

Who it is shared with

Nobody, for their own use. It is not sold, not used for advertising, and not used to train AI models. The two services that run the site handle it on the site's behalf: Supabase for sign-in and the database, and Cloudflare for hosting.

Keeping it, deleting it, and removing access

Google data lives in the account record, so it is deleted the same way: when you sign out without leaving a note, within 25 hours if you leave without signing out, or through Delete my data or a request to me if you left a note. To stop Google from sharing anything with this site again, open your Google Account, go to Security, then Third-party apps & services, and remove this site (myaccount.google.com/connections). That stops future sign-ins but does not delete the record the site already holds, so use Delete my data for that.

Limited Use

This site's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The site reads what your browser reports about your screen, graphics card, processor, battery, network, and settings to decide which easter eggs you get. That reading happens in your browser, and the easter-egg code never sends the raw details anywhere.

When you find an egg for the first time, the site sends only the egg's name, such as giant-screen, so it can show how many visitors found each one. No identifier, IP address, or device detail is stored with it. If your browser sends Global Privacy Control or Do Not Track, nothing is counted at all.

The Domain Recon sends the domain you type to this site's server, and nothing else you enter. If you type an email address, the part before the @ stays in your browser. The server then asks Microsoft's public sign-in discovery and Exchange Autodiscover, the public DNS resolvers run by Cloudflare and, if that fails, Google, and the registry for the domain's top-level domain over RDAP, the protocol that replaced WHOIS, about that domain. Those services receive the domain and a request from Cloudflare's network, not your IP address. The lookup asks Microsoft about a placeholder mailbox, never about a real user, and it never contacts the domain's own servers.

Download PDF builds the file in your browser from the report already on screen. The only requests it makes are for this site's own script and font files, and nothing from the report is sent anywhere. The site does not save the domain, the report, or who ran the lookup. It does count each lookup request: one record in a Cloudflare Analytics Engine dataset holding the result (finished, refused, rate limited, or failed) and the two-letter country Cloudflare places your connection in. The record has no domain, IP address, or browser detail, and I use the counts to see how often the lookup is used. The domain does appear in the address of the requests the server makes, so the request logs described under Hosting and service providers can record it. The lookup is limited to six a minute per visitor, using a hash of your IP address that Cloudflare's rate limiter holds briefly, the same way the contact form is limited.

The Header Analyzer reads the header you paste, or the .eml file you open, inside your browser. The text and the report are not sent to this site or to anyone else, and nothing from them is stored or counted. Copy report puts the text report on your clipboard and nowhere else.

Two analytics tools show me how many people visit, which pages they read, and how fast pages load. Both load only when your browser sends neither Global Privacy Control nor Do Not Track, you have not turned analytics off below, and Cloudflare places your connection outside the EEA, the UK, and Switzerland. That location comes from your IP address, so a VPN or proxy changes it, and a connection Cloudflare cannot place gets no analytics either.

Google Analytics

Google's tag for Google Analytics 4 records the pages you open, the page that sent you here, actions such as scrolling and clicking a link that leaves the site, your browser, operating system, device type, screen size, and language, and a rough location that Google works out from your IP address. Google states that Analytics 4 does not log or store IP addresses. The tag gets nothing from guestbook sign-in: no name, email address, or account ID.

It recognizes a returning browser by two first-party cookies, _ga and one whose name starts with _ga_, which by default expire two years after your last visit. The tag turns off Google's advertising cookies, ad personalization, and Google signals, so Analytics does not link a visit here to a Google account or use it for ads. Google keeps detailed, per-visit Analytics data for at most 14 months, and explains how it handles the data in How Google uses information from sites or apps that use our services.

Cloudflare Web Analytics

Cloudflare's beacon measures how each page performs in your browser: load and render timings, including the Core Web Vitals, which files the page loaded and how long each took, and how much memory it used. It sends those with the page address, the page that linked to it, and a random ID for that one page view, and Cloudflare adds your country, browser, operating system, and device type from the request. The beacon sets no cookies and reads no browser storage, and Cloudflare states that it discards your IP address at its nearest data center instead of storing it. Cloudflare keeps full detail for 7 days and a sample of about 10 percent after that.

Across other sites

Neither tool is set up here to follow you across other websites: the Analytics cookies belong to this site alone, and the beacon uses none. Google and Cloudflare may process this data in the United States and other countries.

Your choice

Local storage holds your theme choice and your easter-egg finds (bb:theme, bb:eggs:v1, bb:player:v1, bb:reported:v1). While you sign in, session storage holds bb:return-to-guestbook so you land back on the guestbook; it is cleared the next time the home page loads, or when you close the tab. Google Analytics adds its _ga cookies when analytics run, and turning analytics off stores bb_analytics. A Supabase session cookie exists only if you sign in to the guestbook. Clearing site data removes all of it, your analytics choice included.

The site runs on Cloudflare Workers. Cloudflare records each request, including your IP address, browser details, and the page you came from, in logs I can read to troubleshoot the site, and deletes them within 7 days. Rate limits on the contact form, the egg counter, and the tenant lookup key on a hash of your IP address, held briefly by Cloudflare's rate limiter. If the contact form shows a Cloudflare Turnstile check, that check is governed by Cloudflare's terms as well.

Supabase hosts the database and runs sign-in, Resend delivers contact-form messages to my inbox, and Google and Cloudflare run the analytics described above. Each handles that data under its own privacy policy.

When this policy changes, the date at the top changes with it. Before sign-in data is used for anything new, you will be asked first.

For questions, or to see, correct, or delete what the site holds about you, use the contact form or email me (Show email address).