Privacy
Last updated October 13, 2026
The short version. This is a personal writing site. I collect as little as I can, I don't sell anything, and there are no ads. There's a simple cookieless visit count for everyone, and anything with cookies only runs if you say yes.
Who's responsible
Matt Depue, writing as CTPO. For anything about your data, email privacy@ctpo.io.
What gets collected, and by whom
Hosting. The site is hosted on Vercel, and its domain name is managed through Cloudflare. Like any web host, it processes basic request data, such as your IP address, browser, and the page you asked for, to serve pages and keep the site secure. I don't use that data to identify anyone.
A cookieless visit count, for everyone. Vercel Web Analytics counts page views: which page, which site sent you, your country, and your device and browser type. It sets no cookies and stores nothing on your device. Vercel tells apart visitors using a hash of the request that it discards after a day, so I can't follow anyone across days or identify you. I see totals, not people. It doesn't run if your browser sends a Global Privacy Control signal.
Analytics, only if you say yes. If you accept, the site loads Google Analytics. It tells me which pages get read and which links and sections get clicked, so I know what's worth writing more of. Google Signals and ad personalization are turned off. If you say no, or your browser sends a Global Privacy Control signal, Google Analytics doesn't load at all. You can change your mind any time with "Cookie settings" at the bottom of every page.
Email updates, only if you sign up. Buttondown runs the mailing list. It stores your email address and basic delivery and open information. Every email has an unsubscribe link.
Hearts on the roadmap. If you heart a note on the roadmap, its public count goes up by one. The counts are stored with Upstash, a database service connected through Vercel. Nothing about who clicked is stored. To stop one person adding the same heart over and over, the site keeps a one-way scrambled code made from your IP address, the day and the note, and deletes it after two days. Your IP address itself isn't stored, and the code can't be turned back into it.
Downloads and "useful" taps. When you download a take-home, its download count goes up by one. When you tap "Useful" on one, that count goes up by one, the same way roadmap hearts work. These are just numbers per file, stored with Upstash. Nothing about who downloaded or tapped is stored, and nothing tracks what happens to a file after you have it.
Things your browser remembers for you. The site saves a few small preferences in your own browser: your analytics choice, whether you've already seen the airline ad, which roadmap notes you've hearted, which take-homes you've marked useful, and which pieces you've started or read, so the cards can mark them. They stay on your device. The hearts are the one exception to "aren't sent anywhere": clicking one sends that heart to the count, and nothing else.
LinkedIn. Comments and discussion happen on LinkedIn, under LinkedIn's own privacy policy. Links to LinkedIn here are plain links. There are no LinkedIn trackers on this site.
What I don't do
No selling or sharing your data, no ad networks, no tracking pixels, no accounts, no fingerprinting, and nothing aimed at children.
How long things are kept
Google Analytics data is kept for the shortest period Google offers, currently two months, and then deleted. Vercel keeps the visit counts as totals for as long as its plan allows. Mailing list details are kept until you unsubscribe or ask me to delete them. Heart counts are kept as totals; the scrambled codes that stop repeat hearts are deleted after two days. Vercel keeps its request logs for a short period as part of running the service.
Your choices and rights
You can ask to see, correct, or delete anything I hold about you, which in practice means an email subscription, by writing to privacy@ctpo.io. I'll answer within 30 days.
If you're in the UK or EU: Google Analytics and the mailing list rely on your consent, which you can withdraw any time. Hosting, security logs, the cookieless visit count and roadmap hearts rely on a legitimate interest in keeping the site running, safe, and worth reading. You can also complain to your local data protection authority, though I'd appreciate the chance to fix it first.
Changes
If this changes, I'll update the date at the top. If it changes in a way that matters, such as a new service handling your data, I'll say so on the site.
The cookie details are on the cookies page.