enaloo.com
Color theme

Privacy policy

What this page covers

This page explains what enaloo.com collects, why, and who can see it. I run the site from Ontario, Canada.

Last updated: 8 October 2026

What I collect

I collect very little. The site has no ads, no comments and no newsletter. You never need an account. An account exists only for the apps section, and only if you make one. I do not sell data or build profiles of visitors. Four things involve your information:

  • The message you send with the contact form.
  • What you send about my apps: bug reports and feature requests, and an account if you make one.
  • Visit counts from Google Analytics, which you can turn off.
  • Ordinary server records kept by my web hosting provider.

The contact form

What I receive

The form asks for your name, email address and message. I use your email address only to reply. When you send the form:

  • The message reaches me by email, through my web host or my email service.
  • The site saves a private copy in its admin area, in case the email fails. Only I can open it. It holds your name, email address, message, the time, and whether the email was sent.

The site does not save your IP address with the message.

How the form stops spam

A hidden field catches bots. The site also lets each internet connection send 5 messages per hour. To count them, it stores a short code made from your IP address, not the address. It deletes the code automatically, usually within a day.

The form also uses Cloudflare Turnstile, a check that tells people from bots. Its script loads on the home page when you come near the form, even if you turned analytics off. Cloudflare receives your IP address and details about your browser. My site also sends your IP address and the result of the check to Cloudflare. The check needs JavaScript. If it is off, please message me on LinkedIn.

Analytics, on by default, with a switch

Google Analytics is on when you visit. On your first visit, a small box tells you so. It has a Turn off button and an OK button. Turn off stops it in this browser. If your browser sends a Global Privacy Control or Do Not Track signal, analytics stays off by itself and the box does not appear. Nothing else changes for you.

Google Analytics counts which pages you open, how far you scroll and which links to other sites you click. It also sees your device, browser and approximate location, taken from your IP address. After you send the contact form, it records that a message was sent, but never what it says. I keep ad personalization and Google signals off. Google keeps the detailed data for 2 months.

The apps section

Reports

On the page of an app you can send a bug report or a feature request. I receive the title, your text and your email address. I also receive the app and, if you give them, the version and the browser. I use your email address only to answer.

The report reaches me by email. The site also keeps it in a private list in my admin area, with a status: new, planned, in progress, done or declined. The site does not save your IP address with a report. The form uses the same protection as the contact form: a hidden field, a time check, 5 reports per hour for each internet connection, and Cloudflare Turnstile.

Accounts, only if you make one

The apps never need an account. An account only lets you follow the reports you sent. If you make one, I keep your email address, an optional display name, and the list of your reports with their status.

You sign in with a link that I send to your email address. The link works once and stops working after 15 minutes. Until then the site keeps only a scrambled form of it. If you want, you can also set a password. Then I keep a scrambled form of the password (never the password itself), the key of your authenticator app in encrypted form, and your recovery codes in scrambled form. A password always comes with a code from your authenticator app.

The account page lets you download your data and delete your account with everything in it, at any time.

The Yes and No buttons

Under each guide, the buttons "Was this page helpful?" count votes for that guide. After you vote, your browser keeps a cookie that remembers it, so you vote once. The site does not link a vote to you.

Cookies and storage on your device

Apart from the two cases described below, the site sets no cookies of its own. It saves two small items in your browser's local storage. Your browser does not send them to the site. They stay on your device:

  • enaloo-consent holds your analytics choice, only if you made one: granted or denied.
  • enaloo-notice remembers that you saw the analytics box, so it does not show again.
  • enaloo-theme holds light or dark, only if you picked one with the theme switch.

While analytics is on, Google Analytics sets cookies named _ga and _ga_ followed by letters and numbers. If you turn analytics off, the site removes them. WordPress, the software behind the site, sets a login cookie only for people who sign in: me, and you if you make an account in the apps section. That cookie lasts up to 14 days. The Yes and No buttons under a guide set a cookie named enaloo_apps_h_ followed by the number of the guide. It lasts one year and holds only the number 1.

Other services and where data goes

These companies can handle some of your data:

  • Google, for analytics, unless you turn it off or your browser sends a Global Privacy Control signal.
  • Cloudflare, for the Turnstile check. Requests to my site may also pass through Cloudflare's network, which helps deliver the site and block attacks.
  • A mail service, which may be my web host or an email service. It sends the sign in links and my answers.
  • My web hosting provider. It keeps ordinary server logs with your IP address, the time and the page you asked for. I do not use them to track you.

Google and Cloudflare run servers in many countries, so they may process your data outside Canada.

The fonts, images and code all come from my own server. When you click a link to another site, it opens in a new tab, and that site follows its own rules.

How long I keep things

  • Contact messages: 12 months. The site then deletes a message by itself, if the email to me was sent. A message whose email failed stays until I delete it. Backup copies of my site may hold a deleted message a little longer.
  • Reports about my apps: until I close them as done or declined, and then 24 months. The site then deletes them by itself. I delete a report earlier if you ask.
  • Accounts: until you delete them on the account page, or ask me to.
  • Sign in links: 15 minutes. Sign in sessions: up to 14 days.
  • The spam limit codes: usually one day.
  • Google Analytics detailed data: 2 months.
  • Local storage items: until you clear your browser data.
  • Server logs: as long as my web hosting provider keeps them.

Your choices

You can change your analytics choice at any time. Use the Privacy settings button at the bottom of any page, then click Turn off or Turn on. Turn off removes the Google Analytics cookies and stops Google from receiving more data.

If you have an account, the account page lets you download your data and delete the account. Without an account you can ask to see or delete a report in the same way as a message.

You can ask to see or delete a message you sent me. Use the contact form from the same email address, and say what you want. I may ask a question to check that it is you. I answer as soon as I can.

Changes to this page

When something changes, I update this page and the date at the top.

Contact

Questions about this page? Use the contact form on the home page.