Privacy.

What website analytics collect

When analytics are enabled, PostHog receives page views and clicks on our three project links and the team contact link. These clicks use fixed labels, rather than recording the email address or text on the page. We remove URL query strings and fragments and limit referring URLs to their domain. Analytics never receive what you type into the project form. We do not create user profiles, connect activity to an account, or use session recordings, heatmaps or automatic interaction capture on this website.

How cookieless measurement works

Our analytics do not set tracking cookies or save an analytics identifier in your browser. PostHog receives network information, including your IP address and browser user-agent, and uses these with the website hostname and a daily rotating salt to generate a hash for estimating daily visitors. The hash used for new activity changes each day. Cookieless measurement does not, by itself, mean that all processing is anonymous or exempt from privacy rules. We use PostHog's US hosting.

Where analytics are enabled

Analytics stay off unless our site settings explicitly permit them for your region. Cloudflare provides the country and region used for this check. If location information or site settings are unavailable, analytics stay off. We do not ask you to accept tracking through a cookie banner.

Your privacy choices

Use Disable website analytics in the footer to stop future analytics without reloading the page. We save only this preference in localStorage; it contains no browser or account identifier and is not sent to our backend. We respect Global Privacy Control, Do Not Track, and an earlier analytics rejection on this website. If your browser cannot save the preference, the footer explains that limitation and analytics stay off. Turning analytics off does not delete information previously collected.

Dated cookie-consent records from our earlier consent banner remain in our backend for up to 730 days under their existing retention policy. New analytics preferences stay in your browser.

Site delivery

Cloudflare hosts this website and its fonts. Loading the site sends ordinary request information, including an IP address, to Cloudflare.

The project form

When you send the Start a project form, your browser sends what you entered (your name, email address, organization, the needs, budget and timeline you picked, and your message) to our server on Cloudflare. From there it goes to two places so our team can read it and reply:

• An email from Vincent (vincent@pinpointlabs.ca) to you, with a copy of what you sent. Vincent and our shared projects inbox receive copies of the same email, so whoever replies to you has your message. Cloudflare Email Service sends it, and our email runs on Google Workspace. When you reply, your reply and ours stay in that email conversation.
• A private channel in our team's Discord server, as a second copy. That post also notes the country Cloudflare reports for your connection and which spam check you passed.

So that the form can't be used to flood someone's inbox, it limits its automatic emails: one per email address and three per internet connection in 24 hours, and a small number per day overall. To apply these limits, our server keeps one-way hashes of your email address and IP address, never the values themselves, in Cloudflare for 24 hours after your latest message. When a limit applies, or the server can't check the limits, your message goes only to our team and you get no automatic email. The limits are best effort: two messages sent at almost the same moment can each get one.

To stop spam, the form uses Cloudflare Turnstile. It runs a check in your browser when you send the form, and asks you to complete a visible check only if that one doesn't pass. Turnstile doesn't read what you type into the form. Cloudflare describes what the check processes in the Turnstile Privacy Addendum.

If the form can't send, or can't confirm that it did, it offers to open a draft in your email app instead. That draft goes nowhere until you send it yourself. If the problem was a lost answer from our server, though, we may already have received what you sent through the form. If you email our team directly, we receive the email address and information you choose to send so we can reply.

Contact & platform privacy

For a privacy request, email privacy@pinpointbowl.com. Our Events Platform has its own Pinpoint privacy policy.