The short version
The site measures its own traffic using first-party analytics stored on its own server. It does not use Google Analytics, advertising pixels, or any third-party tracking that follows you around the web. If you sign up for the newsletter or send a message through the contact form, that information is used only to do the thing you asked for. Nothing here is sold, and nothing is shared except with the service providers needed to actually run the site.
What the site collects automatically
When you visit a page, the site records a basic analytics entry so I can understand which work people look at and where visitors come from. Each entry includes the page you viewed, the page that referred you (if any), your browser type, a coarse device category (desktop, mobile, tablet), and roughly how long the page stayed open. It also stores a one-way hashed version of your IP address — not the address itself — which is used to filter out automated bots, and a short-lived session identifier so multiple pages in one visit can be counted as a single visit rather than several strangers.
This data is first-party: it lives on this site's own server and is not handed to an advertising network or used to build a profile of you across other websites.
Cookies
The site uses a single session cookie, set by the server, so that a visit holds together across the pages you click through. It expires when you close your browser. The site does not set long-lived tracking cookies and does not use third-party advertising cookies.
Campaign links
Some links to this site — from social posts, videos, or campaign pages —
carry tags in the address (the utm_ parameters you may have
seen in URLs) that tell me which post or campaign brought you here. That
information is stored with the analytics entry described above and is used
only to understand which efforts are working. It is not tied to your
identity.
The newsletter
If you subscribe, the site stores your email address, an optional first name if you give one, the date and time you consented, and which link or campaign you subscribed through. Signing up on a clearly labelled opt-in form is how you give consent; there are no pre-ticked boxes. Your email is passed to Flodesk, the service that actually sends the newsletter, which sends you a confirmation message before anything else — so you have to confirm before you receive anything. You can unsubscribe from any newsletter using the link in its footer, and doing so updates both Flodesk and this site's records.
The contact form
When you send a message through the contact form, its contents — your name, email, and message — are emailed to me so I can reply. That's the whole purpose; the message isn't added to any mailing list, and replying to you is the only thing it's used for.
Who else touches this data
Running a website means relying on a few outside services, each of which only handles the slice of data needed for its job:
- DreamHost hosts the site and its database, so anything stored by the site physically lives on their servers.
- Flodesk handles newsletter delivery, and so receives the email address and name of subscribers.
- Stripe handles payment information for any prints you're wonderful enough to buy.
- LumaPrints prints those orders and ships them to your address.
How long things are kept
Analytics entries are kept only as long as they're useful for understanding trends, and the hashed IP portion exists purely for bot filtering rather than long-term identification. Newsletter records are kept for as long as you're subscribed, plus a record of your unsubscribe if you leave, so I can honour that choice. Contact messages live in my email like any other correspondence.
Your choices
You can unsubscribe from the newsletter at any time. You can ask me what information the site holds about you, ask me to correct it, or ask me to delete it — just email nick@novalsi.com and I'll sort it out. Because this is a small operation, that request goes straight to the person who can actually act on it: me.
Changes to this page
If the site's data practices change, this page changes with them and the date below is updated. Continued use of the site after a change means the updated policy applies.
Last updated: July 2026
This is a plain-language summary of how one artist's website handles data, written to be read rather than to survive a deposition. It isn't legal advice, and I'm not a lawyer. I'm just your favorite artist.