Privacy
sh01.io counts visits without cookies and without following you across sites. This page lists exactly what is recorded, how long it is kept and who can see it.
In short
- No cookies for visitors, no localStorage, no advertising or third-party trackers.
- Fonts, images and videos are served from sh01.io itself, so the site makes no requests to Google Fonts or other third parties.
- Your IP address and user agent are never stored.
- Stored rows are deleted after 400 days.
What is recorded
When a page loads, when a work video starts playing and when you click the Instagram link on a work page, your browser sends a small request to sh01.io/api/hit. For each such event one row is stored with these fields, and nothing else:
- Page
- The path of the page, for example /work/kintsugi/. Query strings and #fragments are dropped.
- Work
- Which work the event is about, if any.
- Event
- view (a page was loaded), play (a work video started playing) or reel (a click on the Instagram link on a work page).
- Referrer
- Only the host name of the site you came from, for example instagram.com. Empty for direct visits and for links within sh01.io.
- Country
- A two-letter country code provided by Cloudflare.
- Device
- mobile, tablet or desktop, worked out from the user agent.
- Time
- When the event happened, and its date (UTC).
- Visitor
- A daily-rotating, salted SHA-256 hash, explained below.
The visitor hash
To count unique visitors without cookies, the server computes a SHA-256 hash of a secret salt, the current date (UTC), your IP address and your browser's user agent, and stores only the resulting hash. Because the date is part of the input, the same browser gets a different hash every day, so visits on different days are not linked to each other. The IP address and the user agent themselves are never written anywhere.
To protect the site from abuse, the server also counts requests per network over one-minute windows, keyed by a salted hash of the network address. These counters are short-lived and never written to the database. Requests from known bots and crawlers are discarded.
Retention and access
Rows older than 400 days are deleted by a daily job. The statistics are only visible to the site owner, Oleg Sharshakov, in a private, password-protected dashboard.
Cookies
Visitors get no cookies. The only cookie on sh01.io is the owner's sign-in cookie for the private dashboard at /admin/ (__Host-sh01_admin). It is set only after the owner signs in, is strictly necessary for that, holds no personal data (only when the session started and when it ends, signed by the server) and expires after 30 days or at sign-out.
To slow down password guessing, each failed sign-in attempt is stored as a time and a keyed hash of the network address (the IP address, or its /64 network for IPv6), never the address itself. Only the last 15 minutes of attempts count; rows older than a day are deleted during later sign-in attempts.
Hosting and links
sh01.io is hosted on Cloudflare (Workers, static assets and a D1 database). Like any host, Cloudflare processes the network requests needed to deliver the site, including your IP address, under its own privacy policy.
Links to Instagram and other sites take you to those sites, where their own privacy policies apply. Nothing from Instagram is embedded on sh01.io.
Contact
Questions about this page: hello@sh01.io.