Privacy

Who runs this site

This is the personal website of Joshua Bauder, in New York. I decide what is collected here and why. If you have a question or a request about your data, send it through the contact form.

Analytics

I use PostHog to see which posts and trips get read. It records the pages you view, the page that sent you here, your approximate location (country and city, worked out from your IP address), your device and browser, the links and buttons you click, and how far you scroll. It may also record anonymized replays of how a page was used; anything typed into a form is masked and never recorded.

PostHog sets one first-party cookie (its name starts with ph_) so it can tell one visit from another. You are not identified by name or email. The data travels through this site's own address to PostHog in the United States, and I don't see it alongside anything that identifies you.

If you are in the EU, the EEA, the UK or Switzerland, PostHog does not load at all until you choose “Allow analytics” in the banner. Anyone, anywhere, can change their choice with Cookie settings (also at the bottom of every page). Declining stops analytics and deletes PostHog's cookie from your browser.

I also use Vercel Web Analytics, which counts page views, referrers, and country, device and browser without cookies or any identifier stored on your device. It can't follow you between visits, so it runs for everyone and isn't affected by the banner.

The contact form

When you send a message, I keep what you typed: your name, email address, the reason you picked and your message. It is stored in this site's database (hosted in the United States) and emailed to me through Resend. I use your email address only to reply.

To stop spam, the form keeps a one-way hash of your IP address, which can't be turned back into the address, and uses it only to limit how many messages one connection can send. Cloudflare Turnstile checks that a person is sending the form; Cloudflare processes signals from your browser and connection to do that. I keep messages until I delete them, and I'll delete yours on request.

Hosting

Vercel hosts the site and its images. Like any web host, it processes your IP address and basic request details to deliver pages and keep the site secure, and keeps short-lived logs of those requests.

Other services, only when you choose

• Embedded YouTube, Vimeo and Spotify players load only after you press play. Until then your browser doesn't contact them; after that, their own privacy policies apply.
• Links to X and Instagram posts open those sites; nothing from them loads here.
• Maps on trip pages load map tiles from OpenFreeMap, which receives your IP address in order to send the tiles.

Stored in your browser

A few things are saved only in your own browser and never sent to me: your analytics choice, the progress of the hidden games and the passport stamps, and whether you've already seen the opening animation. Clearing your browser's site data removes them.

What I don't do

• No ads, and no advertising or social tracking pixels.
• I don't sell your data or share it for advertising.
• I don't follow you across other websites.
• There are no visitor accounts.

Your choices and rights

You can turn analytics off at any time with Cookie settings. You can ask me what I hold about you, and ask me to correct or delete it, through the contact form. If you are in the EU, EEA or UK, you also have the rights given by the GDPR, including the right to complain to your data protection authority. If you live in California, note that I don't sell or share personal information.

Children

This site isn't aimed at children under 13, and I don't knowingly collect their data.

Changes

If this changes, I'll update this page and the date at the top.