poietic.tech is the personal site of Benjamin Small. It has no analytics, no advertising, no tracking pixels, and no third-party scripts. If you only read the site, nothing about you is stored anywhere.
What this policy covers
It covers poietic.tech — the website athttps://poietic.tech and its sign-in service athttps://auth.poietic.tech. That is the whole application. There is no mobile app, no separate product, and no other service operated under this name.
Who is responsible
Benjamin Small, Atlanta, Georgia, USA. For anything in this document, including a request to see or delete your data, emailben@poietic.tech.
If you only read
No account, no cookies, no collection. The site is static files served from a Cloudflare Worker. Cloudflare processes the request in order to deliver the page, as any host must, and its network-level logging is described under Processors.
If you sign in
Signing in is optional and exists for one purpose: to let you comment. Signing in with GitHub or Google gives this site:
- Your email address — only if the provider reports it as verified. An unverified address is refused and no account is created.
- Your name as the provider reports it.
- A link to your avatar image — the URL, not the image.
- Your account identifier at that provider — an opaque number, used to recognise you on return.
Your email is the account's unique identity. It is never displayed, never shared, and never used to contact you — there is no mailing list, and the site sends no email.
Each sign-in also records a session: when it began, when it expires, the browser's user-agent string, and the IP address it was created from. These exist so a session can be recognised and revoked; they are not used to build a profile of you.
If you comment
A comment stores its text, the display name you had at the moment you posted, a timestamp, and an internal reference to your account. Comments are reviewed before they appear, so what you write is visible to the site owner whether or not it is ever published.
The display name is frozen at posting time and does not change if you later rename yourself. That is deliberate — a published comment keeps the name it was approved under.
Comments are public once approved. Do not put anything in one you would not want on a public web page indefinitely.
Cookies
Three, all strictly necessary, all set only after you choose to sign in. None are used for advertising or analytics.
__Secure-poietic-session— proves you are signed in. Expires after 10 minutes and is renewed automatically.__Host-poietic-refresh— renews the above. Lasts 30 days, and is readable only byauth.poietic.tech.__Host-poietic-oauth— protects the sign-in exchange itself against tampering. Lives for the duration of one login and is then discarded.
Signing out revokes the session on the server and clears these cookies.
Storage on your device
If you begin writing a comment, the draft is saved in your browser's local storage so that signing in — which navigates you away — does not lose what you typed. It never leaves your device until you press Post, and it is deleted the moment the comment is submitted.
Who else is involved
Your information is not sold, rented, or shared. Three parties are unavoidably involved:
- Cloudflare hosts the site, runs the code, and stores the databases. Request logging is enabled on the sign-in service, which means Cloudflare holds ordinary server logs of requests to it.
- GitHub and Google receive a sign-in request only at the moment you choose one of them, and tell this site the details listed above. This site never sees your password.
One consequence worth stating plainly: on the profile page, your avatar is loaded directly from GitHub's or Google's servers, which means that request reveals your IP address to them. Comment threads do not load avatars at all, so browsing the site involves no third-party requests.
Google user data
When you choose Continue with Google, poietic.tech requests three OAuth scopes and no others. Each is listed here with what it returns and the single purpose it serves:
| Scope | What it gives us | Why |
|---|---|---|
openid | A stable identifier for your Google account (sub) | To recognise you as the same person when you return |
email | Your email address and whether Google has verified it | To identify your account uniquely. An unverified address is refused |
profile | Your name and a link to your profile picture | To show a name beside a comment you post |
That is the entire extent of it. poietic.tech does not request, receive, or store access to your Gmail, Drive, Contacts, Calendar, or any other Google service, and it never sees your Google password. The access token Google issues is used once, at sign-in, to read the three fields above, and is not retained afterwards.
Revoking access. You can disconnect poietic.tech from your Google account at any time atmyaccount.google.com/permissions. Doing so stops any future sign-in. To also delete the account and data held here, email ben@poietic.tech — the two are separate actions, and revoking at Google does not by itself erase what this site already stored.
Use of information received from Google APIs adheres to theGoogle API Services User Data Policy, including its Limited Use requirements. The only Google data requested is your name, email address, and profile picture, and it is used solely to create your account and attribute your comments. It is not transferred to anyone, not used for advertising, and not read by humans except where you have published it in a comment or where it is necessary to resolve a specific problem you have reported.
How long things are kept, and how to have them deleted
- Account record (name, email, avatar link, provider id) — kept until you ask for it to be deleted.
- Comments — kept while published, and handled as you ask on request.
- Session records (including the IP address and user-agent of each sign-in) — kept for up to 30 days from creation, then expired.
- Google access token — not retained. Used once at sign-in and discarded.
To delete your account and everything associated with it, emailben@poietic.tech from the address on the account, or from any address if you say which account you mean. Requests are actioned within 30 days and in practice much sooner. There is no self-service delete button yet; that is a limitation of the site as it stands, stated plainly rather than dressed up, and it does not change the outcome — asking works.
Your rights
Whatever your jurisdiction, you may ask what is held about you, ask for it to be corrected, or ask for it to be deleted. Emailben@poietic.tech and it will be handled. If you are in the EEA or UK, the lawful basis for the sign-in and comment data is the performance of a service you asked for; there is no processing based on legitimate-interest profiling, because there is no profiling.
Deleting an account removes the account record. Comments already published are handled as you ask — removed, or kept with the name detached — because removing an identity and erasing someone's words are different decisions.
Children
This site is not directed at children under 13 and accounts are not knowingly created for them. If you believe one exists, email the address above and it will be deleted.
Changes
If this policy changes, the date at the top changes with it. Changes that affect what is collected or who it goes to will be described here rather than made quietly.