What this site notices, and what it forgets

The short version

There is no cookie banner here because there is nothing to agree to. No cookie is set to count you, and nothing is stored on your device to follow you around. I count visits because I want to know whether the work reaches anyone, and I keep that counting deliberately coarse. The numbers are seen by me and by Bianca Kau, whose site, creativekau.com, runs on the same counter.

• No session recording, no heatmaps of you, no fingerprinting.
• No ad networks, no third-party trackers, no social pixels. Nothing is sold.
• Your browser’s Global Privacy Control signal is honoured automatically.
• One switch, further down this page, turns the counting off for you.

What gets counted

When a page loads, my own server (a small program running at Cloudflare under this domain, not an analytics company) notes which page it was, the site that sent you here if your browser says so, a rough place (country and city, as Cloudflare reports them), the kind of device and browser, and whether the visit came from a person or from one of the many bots and AI tools that read the web.

While you are on a page, a short script from this same domain (/_/p.js) counts how the site is used: how far pages are scrolled, which films are played and for how long, which buttons and links get used, how fast pages load, and any errors. It reads nothing from your device and writes nothing to it, so it cannot recognise you tomorrow.

The two sites are counted side by side but never joined up: nothing connects a visit here to a visit there.

To tell ten visits from one person apart from ten people without giving you an identifier, the server mixes your IP address and browser details with a random value that changes every day and is deleted within 48 hours, and keeps only the scrambled result. Once that day’s random value is gone, the scrambled result can’t be linked to anything, and it is erased from the visit record after 90 days. Your IP address itself is used in memory for that moment and is never written down.

What I actually look at: totals and trends (which pages hold attention, which films people finish, where visits come from), and a list of recent visits showing only the time, the page someone arrived on, where they came from, a rough place, the device, and the network label described next. What someone clicked, scrolled or watched only ever reaches me as part of a total, never as one person’s trail.

The network you visit from

Every connection comes from a network with a public name: a broadband provider, a mobile carrier, a university, or a company that runs its own. Cloudflare passes that name along with each visit, and I keep it as a label such as “BT consumer broadband, London” or, when a company’s own network is recognisable, “probably someone at that company”.

I do this under legitimate interests. As an independent, knowing that a studio I wrote to has looked at the work is how I decide whether and when to follow up, and a label on an organisation is the least intrusive way to know it. The label never names a person, I don’t use services that try to work out who you are, and very small organisations, where a name could point at one individual, are hidden behind “a small studio” unless I deliberately look. Network and place labels are erased after 90 days.

Links I send

When I apply for a role or pitch a project, I keep a private note of when I sent a link and to which organisation. The links themselves are ordinary: I never add tracking codes to them. The dashboard compares the timing, the page and the network of visits against those notes and may suggest that someone at an organisation I wrote to has opened the portfolio. It is a probability, shown to me with its reasons, and it is only ever about an organisation, never a person. Visits from browsers that have opted out are never matched.

Your switch

Turn this on and this site stores one small cookie, sl_optout=1, in your browser: the only cookie this site will ever give a visitor, and it exists because you asked for it. From then on a visit from this browser only adds one to that page’s count for the day. No network label, no place, no matching against anything I have sent, and the on-page script stays silent. It applies to this browser on raulvbrito.com; set it again on other devices, or on creativekau.com, which shares the same counter.

What stays in your browser

A few small preferences live in your browser’s local storage. None of them is sent anywhere on its own, and clearing this site’s data removes them all.

• rb-theme: light or dark, if you switch it.
• rb-master: whether films play at full quality, if you choose that.

Campaign tags on the link you arrived with are not stored at all; see the next section.

Briefs and bookings

If you send a brief through the contact form, what you submit (name, email and the project details you type) is stored in my Cloudflare account so I can reply, and forwarded to my inbox. The counter notes only that a brief was sent, never what was in it.

If you book a call, your name, email, any notes, the time you chose and your time zone are stored with the booking, alongside your browser’s name. The booking creates an event in my Google Calendar with a Google Meet link, and the invitation and any changes reach you by email.

If the link you arrived with during this visit already carried campaign tags (some newsletters and social platforms add them; I never do), those tags can go with a brief or booking you send, so I know where it came from. They are held only while the page is open, never saved on your device, and left out when the switch above is on or your browser sends Global Privacy Control.

Either is used only to answer you and run the call, because you asked me to before any work between us. The copy stored in my Cloudflare account is deleted automatically 12 months after you sent the brief, or 12 months after the call; the emails and calendar event about it are kept no longer than 12 months after our last exchange, unless they become part of work we do together. Ask me to delete it sooner any time: hello@raulvbrito.com.

How long things are kept

• Your IP address: never stored.
• The daily scrambling value: deleted within 48 hours.
• Individual on-page events (scrolls, plays, clicks): 30 days, then only totals remain.
• Visit records (time, page, where you came from, country, time zone, language, device, browser, network type, and any match to a link I sent): 400 days. Network and place labels, organisation guesses, city and the scrambled daily value are removed from them after 90 days.
• Network labels, organisation guesses and city: 90 days.
• Daily totals per page, source and country: 25 months.
• Briefs and bookings: 12 months, as described above.

Who handles it

Cloudflare hosts the site and runs the counter, and stores everything above on my behalf as a processor. Google handles bookings through my calendar.

Bianca and I also read the numbers with Claude, an AI assistant made by Anthropic, a US company, run from our own Anthropic accounts. Claude sees the totals and, when one of us asks, individual visit records: the time, the page, where the visit came from, a rough place, the device and browser, the network and organisation label, and any match against a link we sent. It never sees an IP address or the scrambled daily value. It also writes the short daily summary that reaches our inboxes. Anthropic handles this under its own terms, as a separate recipient rather than on our behalf.

My inbox receives briefs, booking notices and that summary. Apart from Cloudflare, Google and Anthropic, no one else receives any of it, and none of it is used for advertising.

Cloudflare, Google and Anthropic may process this data outside the UK, mainly in the United States. Cloudflare and Google rely on the UK Extension to the EU–US Data Privacy Framework and on standard contractual clauses with the UK Addendum in their terms; Anthropic relies on standard contractual clauses with the UK Addendum.

Who is responsible, and your rights

I’m Raul Brito, a sole trader in the United Kingdom. Briefs and bookings sent through this site are mine alone: I’m their controller. The visit counter is shared: Bianca Kau and I decided together how it works and each of us can read both sites’ numbers, so we are joint controllers for it. Our arrangement is simple: I run the counter and answer every request about it, whichever of the two sites you visited, and anything Bianca receives about it she passes to me.

The legal basis: counting visits, the on-page script, the network labels and matching visits against links I send all rest on legitimate interests (knowing whether the work reaches anyone, keeping the site working, and deciding when to follow up). Briefs and bookings rest on taking the steps you asked for before any work between us.

Write to hello@raulvbrito.com to see what I hold, to correct it, to restrict how I use it, to object to any of it, or to have it erased; for a brief or booking you can also ask for a copy in a machine-readable form to take elsewhere. The switch above is the quickest way to object. Because nothing ties a visit to you, I can’t look up “your” visits by name, but tell me roughly when you visited and from which network and I will find them and delete them. The balancing test behind the network labels is available on request. If you’re unhappy with the answer, you can complain to the Information Commissioner’s Office at ico.org.uk.

If this changes

If the site ever starts noticing more, this page will say exactly what, why, and how to switch it off, in the same change. Questions: hello@raulvbrito.com.