Privacy — With Nate

The short version

There is Google Analytics, but only if you say yes. You are asked once. Decline — or just never answer — and your browser does not contact Google at all, because the tag is never added to the page.
There is no Meta pixel, no session recording, no advertising tags, and nothing that follows you to other websites.
There is one contact form. What you type in it becomes an email to me and is not stored on this website.
There is a counter showing how many times these pages have been loaded, and roughly how many people have been here. It is two numbers in a database with nothing attached to them.
The site shows the weather in New Holland. It never asks where you are — the location is written into the code, and the browser is blocked from asking.
Nothing is stored in your browser except settings you switch on yourself, and those never leave your device.
Everything the site is built from — fonts, images, scripts, the weather — comes from withnate.co.uk. Three other companies your browser contacts: Cloudflare, who host the site and count page loads without cookies; Ko-fi, whose tip box on the home page is a real embedded frame from ko-fi.com; and Google, only once you have agreed to it.

Who I am

With Nate is Nathan Graves, a sole trader working from New Holland, North Lincolnshire. I am the data controller for anything described here. Reach me at [email protected], or [email protected] for anything on this page specifically. I also trade as NAS Digital, which is the same person and the same desk.

The contact form

It asks for your name, a way to reach you, what the project is, an optional rough budget, and whatever you type in the message box.

None of it is stored on this website. There is no database of enquiries and no admin panel. The form turns your message straight into an email and sends it to my inbox, using Resend (Resend Inc., United States) as the delivery service. Resend acts as my processor and handles the message in transit.

There is one hidden field in the form that no human ever sees. If it is filled in, the message is discarded and nothing is sent — it is there to absorb spam robots, and it is the only reason a submission is ever silently dropped.

The form is never used to add you to a mailing list, because there is no mailing list. It exists so I can answer you.

The counter

The strip at the bottom of the page shows two numbers: how many times these pages have been loaded, and roughly how many separate people have visited.

The first is a single integer in a database. Nothing is recorded next to it — not your address, not which page, not when.

The second needs to know whether you have been here before, which it does by leaving one small flag in your browser that says nothing except "already counted". It contains no identifier, it is never sent anywhere except back to this site, and it is not used for anything else. If you would rather not be counted, open the panel at the bottom of the page and turn Count my visit off — it takes effect immediately and it is remembered.

No IP address is stored. There is no list of visitors, because there is nothing to make a list out of.

Analytics, and the one question you get asked

Two things count visits here. They are deliberately not the same, and the difference is the point.

Cloudflare Web Analytics runs on every page. It sets no cookie, writes nothing to your device, and cannot recognise you on any other website. It reports totals — how many pages were loaded, which ones, roughly which country, how fast the page rendered. Cloudflare already serve every image, font and byte you are reading, so this adds no new company to the picture, and there is nothing here for you to consent to because nothing is being stored on your device.

Google Analytics is the other one, and it is why you saw a banner. It sets cookies, it is Google, and the site does not need it in order to work — so it stays off until you say otherwise. If you decline, or close the page without answering, the Google tag is never added to the page and your browser never contacts Google at all. That is deliberately a stronger promise than the usual banner, which normally loads the tag first and asks afterwards.

If you do accept, Google receives which pages you looked at on this site, an approximate location from your IP address, and your browser and device. I use it to see which work people actually look at. The tag is also configured to refuse advertising storage and ad personalisation outright, so even switched on it is measurement rather than ad targeting.

You can change your mind here, at any time, and it takes effect immediately:

The Ko-fi tip box

The home page has a tip box, and it is a real frame served by ko-fi.com rather than a picture of one. That means your browser fetches it from Ko-fi whenever you load the home page — you do not have to click it, or tip anything, for that to happen.

Inside that frame Ko-fi is its own website, so it can set its own cookies and apply its own privacy policy, and I can neither see nor control what it does in there. I have deliberately limited what the page is allowed to embed to ko-fi.com and nothing else, but that is a limit on what can appear, not a limit on what Ko-fi does with a visit once it has one.

If you would rather not be in touch with Ko-fi at all, avoid the home page or use a browser that blocks third-party frames — everything else on this site is served from withnate.co.uk.

The weather

The site changes slightly with the weather in New Holland — the picture degrades a little in bad conditions, and the colours shift with the time of day.

It never asks where you are. The coordinates are fixed and written into the code, and the site sends a browser instruction (a Permissions-Policy header) that blocks location access outright — so this is enforced rather than merely promised.

The forecast comes from MET Norway, under CC BY 4.0, and it is fetched by this website's own server, not by your browser. MET Norway never sees your address and has no idea you exist.

Settings kept in your browser

If you turn the sound on, switch the effects off, or change the colours, that choice is remembered in your browser so the site does not forget it next time. The same applies to the counter opt-out.

These are stored on your device only. Nothing is sent anywhere, none of it identifies you, and clearing your browser data clears all of it. Your answer to the analytics question is kept the same way — which is also why clearing your browser data means you get asked again.

What happens anyway

This site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes the requests your browser makes in order to serve the page and to keep the site up and secure. That involves your IP address, in the ordinary way that loading any website does. I do not have access to per-visitor logs, and I do not build anything on top of them.

If you email me

Mail to withnate.co.uk addresses is forwarded by Cloudflare Email Routing into a Google (Gmail) mailbox. I read it there, and reply from there.

If you buy something

Purchases happen on Etsy, Gumroad or itch.io, not here. Those companies take your payment and hold your account, under their own privacy policies. What reaches me is the order: what you bought, the name and address needed to fulfil it, and any message you sent with it. I never see your card details.

Commissions and the photo you send

If you send a photo for a portrait, it is worked on here, on my own machine, with my own tools. It is not uploaded to somebody else's AI service. I keep it while the job is live and for about a year afterwards in case you want the same piece again or in a different size, then it goes. Ask me to delete it sooner and I will.

Why I am allowed to do any of this

Under UK GDPR I need a lawful basis for anything that counts as personal data.

The contact form: legitimate interests. You deliberately contacted me about my work and I cannot answer without your message. Nothing else is done with it, and there is no marketing. Not consent, because consent is the wrong basis for a message somebody chose to send; not contract, because there is no contract until you order.
Your order and your photo: performance of a contract. I cannot make the thing without them.
Keeping the site online and secure: legitimate interests. The ordinary business of running a website.
The page counter: no personal data is processed, so this does not arise. The visitor flag is a preference stored on your device with an opt-out, not a profile.
Google Analytics: consent. You are asked, the answer is remembered, and nothing loads unless it was yes. Consent is the honest basis here precisely because the site works perfectly well without it — which is what makes saying no a real option rather than a formality.
The Ko-fi tip box: legitimate interests. Offering a way to support the work is an ordinary thing for a small business to do, and the frame is limited to the one page it belongs on. What Ko-fi does once your browser reaches it is Ko-fi's own processing under Ko-fi's own policy, not mine.
Cloudflare Web Analytics: legitimate interests. Nothing is stored on your device, there is no cross-site identity, and it is the host already serving the page. Knowing whether anyone reads this is an ordinary thing to want, and this is the least intrusive way I found to know it.

How long things are kept

Emails and enquiries: around a year if nothing comes of them; kept with the order if something does.
Commission photos and finished files: about a year after the job, unless you ask sooner.
Order records: six years, because HMRC requires it.
The counters: indefinitely, being two integers with nothing attached.

Information going outside the UK

Cloudflare, Google, Ko-fi, Resend, Etsy, Gumroad and itch.io are US companies and may process data outside the UK, under the transfer safeguards in their own terms. Google Analytics is on that list only if you agreed to it; if you did not, nothing of yours reaches Google at all. MET Norway is deliberately not on that list: your browser never contacts it, so no data of yours goes there at all.

Your rights

You can ask me what I hold about you, ask for it corrected or deleted, ask me to stop using it, or ask for a copy. Email [email protected] and I will answer within a month, usually the same week. It is one person and a small inbox — there is not much to search.

Automated decisions

Nothing here decides anything about you. There is no profiling and no scoring.

Children

This is not aimed at children and I do not knowingly collect anything from them. If a child has sent me something, tell me and I will delete it.

Complaints

Tell me first if you can — it is usually quicker. If that does not resolve it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this page

If the site changes, this page changes in the same commit. The date at the top is the honest signal — if it has not moved, nothing here has.

What this site does, and does not, know about you.