# Privacy

> What doug.sh records about a visit, why, and how to opt out.

- URL: https://doug.sh/privacy/
- Author: Doug Calobrisi
- Date: 2026-09-20


This site keeps its own visitor statistics instead of relying on a third
party. Here is exactly what that involves.

## What is recorded

For every request the server sees: the page or file requested, the time, the
referring site if your browser sent one, the request headers your browser
sent (user agent, language, and any cookies for this site), a coarse location
derived from your IP address (country, region, city), and a hashed identifier.
The IP address itself is not stored.

If JavaScript is enabled, a small first-party script also reports how long a
page was visible, how far you scrolled, clicks on links to other sites, and
newsletter signups.

## Cookies and identifiers

The site sets one cookie, `_dsv`, a random 16-character id with a life of 400
days. It exists so that return visits can be recognised and reading paths
understood. It is first-party, `HttpOnly`, and shared with no one. Without it,
a hashed combination of your IP address and browser details serves the same
purpose, so blocking cookies does not by itself prevent recognition.

Google Analytics is also loaded for the time being, for comparison, and is
subject to Google's own policies.

## Opting out

Send the [Global Privacy Control](https://globalprivacycontrol.org/) signal
(on by default in Brave and DuckDuckGo, a setting in Firefox) or the older
`DNT: 1` header. Visitors who send either are given only a daily-rotating
hash that cannot be linked across days, any existing `_dsv` cookie is
cleared, and it is not read again.

## Retention and access

Raw request headers are removed after 30 days; the rest of a record is deleted
after 400 days. Requests for assets such as images and scripts keep their
headers for 7 days and are deleted after 90. The site's own data lives in a
database that only the site owner can read; it is not sold, shared, or used
for advertising. Google Analytics, while it remains, is the one third party
that receives visit data, as described above. Questions to
[doug@calobrisi.com](mailto:doug@calobrisi.com).