This Privacy Policy describes what happens to your information when you visit https://everbase.studio (the “Site”) or get in touch about work. It names each thing the Site does with your data and who else is involved.

The short version

The Site uses Google Analytics 4 to count visits and see which pages are read. That sets two cookies and tells Google which pages you viewed, on what kind of device and where you arrived from. Advertising features and ad personalization are off. If you are in the EEA, the UK or Switzerland you are asked first, and if you decline, nothing is stored and nothing is sent to Google. A Global Privacy Control signal is honored, and “Cookie settings” in the footer changes your answer at any time. If you send a project brief or email me, I hold what you send so I can reply and keep a record of the work.

Analytics

The Site loads Google Analytics 4, a measurement service run by Google LLC. I use it to count visits and to see which pages are read, which decides what gets written and what gets fixed. It is the only measurement here: there are no advertising or tracking pixels, no session recordings and no heatmaps.

When it runs, it collects:

The pages you view and when you view them.
Your approximate location (country, region and city), which Google works out from your IP address. Google states that Google Analytics 4 does not log or store the IP address itself.
Your device type, operating system, browser, screen size and language.
The page or site that sent you here.
Scrolling most of the way down a page, clicks on links that leave the Site, file downloads, and the fact that a form was started or submitted (not what was typed into it). Google calls these enhanced measurement.

To tell one visit from the next, Analytics sets two cookies on this domain: _ga and _ga_NR2NW8Y2XR. Each holds a random identifier, not your name or your email address, and each expires two years after your most recent visit unless you delete it sooner.

Advertising features are off. The tag is set up with Google signals and ad personalization disabled, and the consent signals for ad storage, ad user data and ad personalization are denied for every visitor and never switched on. The Site runs no ads, and I do not use this data to build audiences or to target anyone.

Google LLC processes the data on its own systems, under its privacy policy. Google Analytics keeps visit-level data, the kind tied to a cookie identifier, for a period set on the account. The default is 2 months and this account uses the default. Totals in standard reports, such as how many visits a page had, carry no identifier and are kept longer.

Who is asked first, and how to say no

If your browser's timezone is a European one, the Site asks before any of the above happens. That covers the EEA, the UK and Switzerland, and some of their neighbors, because a timezone is a blunt instrument. Until you answer, and if you decline, Google's tag is not loaded at all: no cookie is set and no request goes to Google. If you accept, Analytics runs as described above. Everywhere else it runs unless you turn it off.

The timezone is read inside your browser and sent nowhere. Because it is an approximation, there is a second check: Google's tag is told to treat anyone whose IP address is in the EEA, the UK or Switzerland as not having consented. So if you are in one of those countries on a device set to a timezone elsewhere, you will not see the banner, and Analytics counts the page view without cookies and without an identifier until you accept.

If your browser sends a Global Privacy Control signal, the Site treats it as a decline wherever you are. The tag is not loaded and no banner is shown.

“Cookie settings” in the footer reopens the choice for anybody. Declining there stops the measurement and deletes the two cookies. Your answer is kept in your browser's own storage rather than in a cookie, under the name nb-analytics-consent, and it stays on your device. Google also publishes a browser add-on that opts you out of Google Analytics on every site that uses it. With JavaScript turned off, none of this loads.

What else the Site collects

Apart from Analytics, nothing that identifies you. The Site sets no other cookies and runs no advertising or tracking pixels.

Typefaces are still served from this domain rather than from somebody else's network: they are downloaded when the Site is built, so your browser never asks Google for a font.

The host. Cloudflare serves the Site. Like any web server it handles your IP address and browser details in order to send you the page, and may keep short-lived operational logs. Its practices are described in its own privacy policy.

Sending a project brief

The form on the start a project page posts to Formspark, which receives what you typed into it and passes it on to me. Nothing on that page contacts them until you press the button. Formspark processes and stores that submission on its own systems, under its privacy policy.

While you are typing, the form keeps a copy of what you have written in your own browser so a failed submission does not lose it. That copy never leaves your device and is cleared once the brief is sent.

Running the site performance check

The same check sits behind the site performance check page and the AI visibility check page, which shows one part of its report. It takes one thing from you: the address you type into it. That address goes to the machine that runs the check, which fetches the page at it the way a browser would, reads what is in the markup, and sends the report back to your browser. It also fetches the site's robots.txt, llms.txt and sitemap, and a few pages that page links to: pricing, demo and contact pages, and any page it links to at a named section, to see that the section is there. It does not crawl the rest of the site, and it does not sign in to anything. The AI visibility check sends only the site's homepage address, even if you type a deeper one.

One part of the report is not measured here. The speed numbers come from Google PageSpeed Insights, so the address is sent to Google in order to be measured, and Google handles it under its own privacy policy. Everything else is read from the site itself, which is why the rest of the report still appears on the runs where PageSpeed does not answer.

Your IP address reaches the machine running the check, because that is how it holds the limit of five runs a minute, and because any web server handling a request has it. Beyond that the check keeps nothing: the address is written to no database, the program's own log is discarded line by line as it is written, and the report exists in the response and in the tab you are reading it in. No copy is saved and none reaches me unless you choose to send me one.

The optional migration estimate keeps your answers on the page. Choosing “Review with me” saves a temporary copy in this tab's session storage so you can review it on the inquiry form. The transfer is available for one hour and is removed when added to the form. It then follows the form's draft behavior above. No scope brief reaches me until you submit the inquiry.

Running the schema markup validator

The schema markup validator takes the address you type. It goes to my Worker on Cloudflare, which looks up the host name through Cloudflare's public DNS, fetches that one page, following up to three redirects and looking up each new host name the same way, and sends the JSON-LD it found back to your browser. A check stops after about 8 seconds. It never sends the rest of the page back. Each site along the way sees a request from Cloudflare that identifies itself as NewBaseSiteCheck, and not your IP address or your cookies.

The tool stores neither the address nor the page, and it writes neither to a log. To limit how often one site is fetched, the Worker keeps the host name and a count in its memory, with no link to you. To enforce the limit of five checks a minute, a limit it shares with the site performance check, the Worker keeps your IP address (for IPv6, the first half of it) in its memory. My code writes it nowhere else. It can stay in that memory after the minute has passed, until a later clean-up or until Cloudflare retires that copy of the Worker. Cloudflare runs the Worker and handles that traffic under its own privacy policy. Anything you paste instead of an address stays in your browser tab and is sent nowhere.

Emailing me

If you email me, I receive your email address, your message and anything you attach. That mail sits in a standard email account and is used to reply to you, to quote and deliver work, and to keep a record of what was agreed. I do not add you to a mailing list, and there is no mailing list to add you to.

Who else sees it

Nobody, other than the providers named above who deliver the Site, measure it or carry the mail, each under their own terms. I do not sell your information, share it with advertisers, or use it to build an advertising profile. I would disclose it only if the law required it, and I would tell you unless I were forbidden from doing so.

How long I keep it

Enquiries that do not turn into work are deleted once the conversation is clearly over, unless something in them has to be kept for the reasons below. Correspondence about actual projects is kept for as long as I may need it for tax, contractual or legal reasons, and then deleted. How long Google Analytics keeps its data is set out under Analytics above.

Your choices

You can ask me what I hold about you, ask for it to be corrected, or ask for it to be deleted. I will do it, except where something has to be kept for the tax, contractual or legal reasons above, and I will tell you if that applies. The analytics choice is separate and needs no email: it is “Cookie settings” in the footer.

Do Not Track

The Site does not read the Do Not Track header. The signal it follows is Global Privacy Control, described above, and the footer's “Cookie settings” turns measurement off whatever your browser sends.

Minors

The Site and my services are intended for businesses and are not directed at individuals under the age of 13.

Last updated

November 6, 2026.

Changes to this policy

If what the Site does with data changes, this page changes with it. The version on this page is the one that applies.

Contact

Questions about any of this, or a request about your own data, go to hello@everbase.studio.