What this site stores.

When you paste an address into the audit tool, your browser sends that address to Google’s PageSpeed Insights API. The measurement runs on Google’s infrastructure, not this one. Google’s handling of that request is covered by their own privacy policy.

• The result is cached for 24 hours. The address you gave and the summarised report are written to a file on this server so a second look is instant. After 24 hours the file is deleted, and the code that deletes it runs on ordinary requests rather than waiting for a scheduled job.
• After that, only aggregates survive. A monthly counter records how many audits ran, a histogram of the scores, and a histogram of page weights. Those are counts in buckets. No address, no identity, and nothing that can be joined back to a person or a site.
• A rate counter holds a hashed address. To keep the tool to three runs an hour per visitor, a file records a count against a one-way hash of your IP address for the current hour. Your actual address is not stored.
• The fourth run in an hour shows a Cloudflare Turnstile check. Apart from the analytics tag described below, that check is the only third-party script this site loads, it only loads on that one page, and it is not loaded at all unless you hit the limit.

• What you submit is stored before it is emailed. Each submission is appended to a file outside the web root, then sent to brad@aftermathwebdesign.com. Storing first means a mail failure cannot lose your enquiry.
• Partly completed quote forms are stored too. The quote form has three steps, and moving between them saves what you have entered so far. If you start it and leave, whatever you had filled in, which may include your name, email and site address, is on this server. Say so if you would rather it were not and it will be deleted.
• A partial is deleted when the full submission arrives.
• Submissions are kept while they are useful. An enquiry that becomes a project is kept for the life of the project and the records that follow it. One that does not is deleted within a year.
• Nothing is sold, shared or passed to a marketing platform. There is no CRM behind this. It is an inbox.

• Google Analytics, and nothing besides it. The site loads Google Analytics 4, measurement ID G-JC4WQDVBTE. It records which pages were opened, roughly where the visit came from, and the kind of device it was on. No advertising pixels, no heatmaps, no session recording, and no profile built about you. What Google does with what it receives is covered by their terms, the same as the PageSpeed measurement above.
• Two cookies, and both belong to that tag. Google Analytics stores _ga and _ga_JC4WQDVBTE in your browser so a second visit is not counted as a new person. They are first-party, they are not used for advertising, and nothing else on this site sets a cookie. There is no banner asking you to accept them, because a page count is the whole of what they do.
• Blocking it changes nothing. Tracking protection, an ad blocker or Google’s own opt-out add-on all stop the tag, and every page here works exactly the same way without it.
• No fonts, scripts or images from anyone else. Every other asset comes from this domain. The two exceptions are the analytics tag and the Turnstile check described above.
• The host keeps ordinary server logs. Requests to this site are logged by the hosting provider with the usual details, including IP address, for a short retention period. That is standard hosting operation and it happens for every site on the internet.
• The performance line in the footer stays in your browser. It is measured by your own device and never sent anywhere.