Last updated: 24 October 2026
This is a personal website run by Jordan Mitchell (“I”, “me”). I’ve kept it deliberately simple: no analytics, no advertising, no tracking pixels and no comment or form services. This policy explains the small amount of data that is still involved in running a website, and who handles it.
The short version
- I don’t use analytics or tracking of any kind, so I don’t know who you are or what you looked at.
- The only cookie is a strictly necessary one that remembers you’ve seen the cookie notice.
- The browser tools in Apps run on your own device. What you type, upload or generate isn’t sent to me.
- The Cyber Risk Scanner sends only the domain you enter to my server, checks it once, and doesn’t store or log it.
- If you email me, I’ll only use your details to reply.
Who is responsible for your data
Jordan Mitchell is responsible for this website. For any privacy question or request, email Reveal email (enable JavaScript).
Information collected when you visit
Hosting (Netlify)
This site is hosted by Netlify. Like any web host, Netlify’s servers receive technical details your browser sends with each request, such as your IP address, browser type and the page requested. Netlify uses these for delivering the site, security and abuse prevention, under its own privacy policy. I don’t use Netlify Analytics, and I don’t access or combine this data to identify visitors.
Fonts and images from other providers
To load quickly, some content comes directly from third-party servers. When your browser fetches it, that provider receives your IP address and basic browser details, as happens with any web request:
- Fonts: Bunny Fonts (fonts.bunny.net), a privacy-focused, EU-based font service that says it doesn’t log or track visitors.
- Images: Bunny CDN (b-cdn.net), Unsplash, and occasionally logos or images hosted by the businesses featured on the site.
None of these are used for tracking by me, and no cookies are set through them by this site.
Links to other websites
The site links to LinkedIn, PayPal (for optional donations), social sharing services and other websites. Nothing is sent to them unless you click a link, after which their own privacy policies apply.
Cookies and local storage
| Name | Type | Purpose | How long |
|---|---|---|---|
cc_cookie | Strictly necessary cookie | Remembers that you’ve acknowledged the cookie notice, so it isn’t shown on every page. | Up to 6 months |
theme | Local storage (only if set) | Remembers a light or dark display preference, if you choose one. It never leaves your device. | Until you clear it |
Because these are strictly necessary or set at your request, UK law (PECR) doesn’t require consent for them. There are no analytics, advertising or tracking cookies. You can remove both at any time through your browser settings.
Browser-based tools
The tools in Apps (such as the password, QR code, favicon and email signature generators, the image compressor, Conceal and the text diff checker) run entirely in your browser. Files and text you use with them stay on your device and aren’t uploaded, saved or seen by me.
The site search also runs in your browser using a pre-built index, so your search terms aren’t sent anywhere.
Cyber Risk Scanner
When you run a check, only the website address you enter is sent to my Netlify function. It’s used to:
- request that site’s public response headers once,
- read its TLS certificate on port 443, and
- look up its public SPF and DMARC records in DNS.
The address and results aren’t stored, logged or linked to you, and the tool sets no cookies. The score card and its downloadable image are drawn in your browser and aren’t uploaded anywhere.
To prevent abuse, Netlify applies a short, automatic rate limit at the network level, based on IP address. This happens within Netlify’s infrastructure before the request reaches my code, and I don’t see or store your IP address.
If you contact me
If you email me or message me on LinkedIn, I’ll receive whatever you choose to send, such as your name, email address and message. I’ll use it only to reply and deal with your enquiry. I won’t add you to a mailing list or share your details. My legal basis is my legitimate interest in responding to you, and I delete correspondence once it’s no longer needed.
Email to my personal address is handled by DuckDuckGo’s email protection service and forwarded to my inbox, so their privacy policies also apply.
Your rights
Under UK data protection law you have the right to access, correct or delete personal data I hold about you, to object to or restrict how I use it, and to data portability. Because the site collects so little, in most cases I won’t hold anything about you. If you’ve emailed me, contact me at the address above and I’ll help.
If you’re unhappy with how your data has been handled, you can complain to the Information Commissioner’s Office (ICO), although I’d appreciate the chance to put things right first.
Children
This site isn’t aimed at children and I don’t knowingly collect information from anyone under 13.
Changes to this policy
If anything about how the site works changes, I’ll update this page and the date at the top.