Privacy
Short, because there is not much of it.
Effective 26 August 2026
Groundwork is one person building software. This page is about what happens to your details when you get in touch. What happens to a client's project data is a stronger commitment and it is on the approach page: your database, your deploy, downloadable in full, not pooled and not trained on. That promise stands, and this page is the same promise applied to the enquiry form — because it would be odd to be careful with a client's data and careless with a stranger's.
What I collect
If you fill in the enquiry form: your name, company, email, roughly how many people you are, what you are after, and whatever you write in the message. That is the whole list — it is the form, and there is nothing hidden behind it.
I also record a truncated version of your network address —
the first three parts, so 203.0.113.0/24 rather than the full
thing. It is there to spot a flood of junk from one source, not to identify
you, and it cannot be traced back to a person.
If you just read the site: nothing. No analytics, no cookies, no pixels, no session recording, no fonts pulled from someone else's server. There is no tracking on this site to opt out of.
What I do with it
I read it and I reply. That is the entire purpose.
It goes to one inbox — mine. It is not added to a mailing list, not loaded into a CRM, not enriched against a data broker, not sold and not shared. If we end up working together, your details become part of a normal client relationship and we will have a contract that says so.
Who else sees it
- Resend — the service that delivers the notification email to me. They see what you sent, in transit.
- My hosting provider — the server this site runs on holds the database the enquiry is stored in.
That is the complete list. No one else.
How long I keep it
Two years from when you send it, then it is deleted. If we work together, project records last as long as the engagement and the period my accountant needs afterwards.
What you can ask for
Email me and I will do it — no form, no verification theatre:
- A copy of what I hold about you.
- A correction, if it is wrong.
- Deletion. I will confirm when it is done.
- To never be contacted again. Reply STOP to anything I send and you go on a suppression list that is checked before every send.
I will acknowledge within a few days and finish within 30 — well inside the 45 days the law allows. If I ever say no to a request, I will say why and how to appeal it.
Security
TLS on everything. Passwords hashed with PBKDF2 and per-user salts. The admin sign-in is rate limited per address and per account. The session-signing key lives in the environment, never in the database or a backup. Enquiries are validated on the way in so nothing typed into the form can affect anything else.
Changes
If this changes materially I will update the date above. It is unlikely to change much — the honest version of this page is short and it is meant to stay that way.
Contact
[DECISION NEEDED: your real email address and physical postal address. The postal address is the same one that goes in the outreach footer — fill both in at once.]