Privacy Policy

Bay Area Flux and Magnetism, LLC

Effective date: October 23, 2026

The short version

• The only personal information you give us through this website is what you type into our contact form: your name, email address, the type of inquiry, and your message.
• We use it to reply to you. We don't sell it, share it for advertising, or add you to a mailing list.
• We don't use analytics or advertising tools. The only third-party code on the website is Google reCAPTCHA, which protects the contact form from spam.
• Our website is hosted by Netlify, which processes the technical information any web server sees (such as IP addresses) and stores the messages you send us.
• When you use the contact form, Google processes technical information about your visit to run the reCAPTCHA spam check. That is a security measure, not analytics or advertising.
• We delete contact form messages 12 months after we receive them, with narrow exceptions explained below.
• You can ask us to show you, correct, or delete the information we have about you. Use the contact form and choose "Privacy Request."

The rest of this policy explains these points in more detail.

1. Who we are and what this policy covers

Bay Area Flux and Magnetism, LLC ("we," "us," or "our") is a California limited liability company based in the San Francisco Bay Area. We do technical consulting, developer education, software development, and independent creative projects.

This policy describes how we handle information about visitors to our website at https://bayareafluxandmagnetism.com (the "website"). It applies to everyone who visits the website, wherever you live. Section 9 has additional detail for California residents.

This policy does not cover:

• Nightcap, an iOS app we're building and mention on the website. Nightcap isn't released yet. When it is, it will have its own privacy policy describing what the app does with information.
• Information we exchange with clients, students, and collaborators outside the website, for example by email or under a contract. Those relationships are governed by our agreements with you.

This policy took effect on the date shown at the top. Section 12 explains how we'll tell you about changes.

2. Information we collect

Information you send us through the contact form

The website has one way for you to send us information: the contact form. When you use it, we receive:

• your name,
• your email address,
• the inquiry category you select ("General Inquiry" or "Privacy Request"), and
• your message, including anything you choose to include in it.

Sending us this information is your choice. If you don't use the form, the only information connected to your visit is the technical information described next.

Please don't put sensitive information in your message, such as passwords, government ID numbers, financial account details, or health information. We don't need it to answer you.

Technical information our hosting provider processes

Like every website, ours runs on servers, and those servers see some technical information about each visit. Our hosting provider, Netlify (see Section 4), automatically processes:

• your IP address;
• your browser type and version, and the operating system of your device;
• the pages and files you request, the date and time of each request, and the web page that referred you to ours, if any; and
• similar information found in standard server logs.

When you submit the contact form, Netlify also records your IP address, your browser's identifying string (the "user agent"), the referring page, and a timestamp alongside your message.

Technical information Google processes for the spam check

The contact form is protected by Google reCAPTCHA (see Sections 4 and 5). When you load or use the contact form, Google processes technical information about your browser and device, your IP address, how you interact with the form, and a cookie it sets in your browser, in order to tell people from automated spam programs. We don't receive this information. We only learn whether a submission passed the check.

Information we don't collect

• We don't have user accounts, logins, or payments on the website.
• We don't use analytics tools or advertising pixels. Apart from the reCAPTCHA spam check on the contact form, there is no third-party code on the website (see Section 5).
• We don't buy information about you from data brokers or combine what you send us with information from other sources.

3. How we use information

We use the information you send through the contact form to:

• read and reply to your message, and follow up on what you asked about;
• handle privacy requests (see Section 9); and
• comply with the law or protect our legal rights if we ever need to, for example if a message involves a threat, abuse, or a legal dispute.

We use technical information such as IP addresses only to keep the website running and secure: so that Netlify can deliver pages to your browser and troubleshoot problems, and so that Netlify and Google can filter spam and detect abuse on the contact form.

Here is what we don't do with your information:

• We don't sell it.
• We don't share it for advertising, and we don't do targeted advertising.
• We don't add you to a mailing list or send you marketing emails because you contacted us.
• We don't use it to build a profile of you or to make automated decisions about you.

4. Hosting and service providers

We use two outside services to run the website.

Netlify, Inc. (San Francisco, California) hosts the website and runs the contact form through its Netlify Forms service. Netlify's servers deliver the website to your browser, keep the server logs described in Section 2, and store the messages you send us. Netlify processes this information on our behalf and on our instructions, under the data processing terms that are part of our agreement with it. You can read Netlify's own privacy statement at https://www.netlify.com/privacy/ and learn about its security program and the sub-processors it uses at https://www.netlify.com/trust-center/.

Netlify, in turn, relies on other companies to provide its service. Two things are worth knowing:

• Netlify's infrastructure runs on large cloud providers, including Amazon Web Services and Google Cloud, in the United States.
• Netlify checks every contact form submission for spam using Akismet, a spam-filtering service operated by Automattic, Inc. This means the contents of your message, along with your IP address and related technical details, are sent to Akismet so it can decide whether the submission looks like spam. Automattic's privacy policy is at https://automattic.com/privacy/.

Netlify publishes its full list of sub-processors at the Trust Center link above.

Google LLC (reCAPTCHA). The contact form uses Google reCAPTCHA, set up through Netlify, to tell real people from automated spam programs. When you load or use the contact form, your browser connects to Google, and Google processes technical information about your browser and device, your IP address, how you interact with the form, and a cookie it sets for this purpose (see Section 5). Google processes this information as a security measure, to provide the reCAPTCHA service and keep it effective at detecting bots and abuse, and not for website analytics or advertising. Google describes how reCAPTCHA works at https://www.google.com/recaptcha/about/, and its privacy policy is at https://policies.google.com/privacy.

Netlify and Google are the only companies we use to process information collected through the website. The other place your message goes is our business email: when we read and reply to your message, it passes through the email service we use to run our business, like any other email.

5. Cookies, analytics, and tracking

Analytics and advertising

We don't use Google Analytics or any other analytics service. We don't use advertising pixels, retargeting, heat maps, session recording, or other behavioral tracking tools. We don't do targeted advertising, and there are no ad networks on the website.

Cookies

The website itself doesn't set cookies, and we don't use any Netlify features (such as A/B testing or visitor accounts) that place cookies in your browser.

The one exception is Google reCAPTCHA on the contact form. When reCAPTCHA runs, Google sets a cookie in your browser (named _GRECAPTCHA) that it uses for its risk analysis, that is, to help tell people from bots. This cookie is necessary for the spam protection to work, and it isn't used for advertising or analytics. You can block or delete it through your browser settings. If you do, the rest of the website will still work, but the spam check on the contact form may be harder to pass.

Our hosting provider could also, in limited situations, use a strictly necessary cookie or similar technical storage to deliver the website securely or to protect it from abusive traffic. If that happens, it isn't used for advertising or to track you, and we'll update this policy if we learn that such cookies are being set.

Other parties and tracking across websites

Google is the only other party that collects information about you on our website, and it does so only on the contact form, for the reCAPTCHA spam check. Because the reCAPTCHA cookie is set by Google, Google may recognize your browser on other websites that also use reCAPTCHA. Google's reCAPTCHA documentation says the service processes this information for security, fraud, and abuse prevention. We don't control how Google handles it.

Apart from reCAPTCHA, we don't allow other companies to collect information about your online activity over time and across other websites when you use our website. There are no advertising networks, social media widgets, or third-party analytics scripts here.

How we respond to Do Not Track and Global Privacy Control signals

Some browsers let you send a "Do Not Track" signal or a Global Privacy Control signal to the websites you visit. Because we don't track visitors across websites and don't sell or share personal information, there is nothing for these signals to switch off. We treat every visitor the same way whether or not your browser sends one. The reCAPTCHA spam check runs regardless of these signals, because it is part of how the contact form is protected.

Links to other websites

The website may link to other websites. Those sites have their own privacy policies, and we don't control them.

6. When we share information

We share the information you send us only in these situations:

• With our service providers. Netlify, and the sub-processors it uses (described in Section 4), store and process information so that the website and contact form work. Google processes technical information for the reCAPTCHA spam check on the contact form, as described in Sections 4 and 5.
• When the law requires it. We may disclose information if we are legally required to, for example in response to a valid subpoena or court order, or if we reasonably believe disclosure is necessary to protect someone's safety or to enforce our legal rights.
• If our business changes hands. If our company is ever sold, merged, or reorganized, contact records could transfer to the new owner, who would be bound by this policy for that information unless you are told otherwise.

We don't sell personal information. We don't share it with third parties for their own marketing or advertising. We don't give it to data brokers.

7. How long we keep information

Contact form messages. We delete contact form submissions 12 months after we receive them. There are two exceptions:

• if the law requires us to keep a message longer; or
• if the message relates to a business matter that is still active, for example a project we're working on together or a dispute. In that case we keep the message for as long as the matter requires and delete it when the matter is resolved.

The same schedule applies to copies of your message that we keep in our business email, and to submissions that Netlify's spam filter has flagged.

Netlify, which stores form submissions for us, does not delete them automatically. Deleting on this schedule is our commitment, and we carry it out ourselves.

Privacy requests. If you make a privacy request, we keep a brief record of the request and how we responded for 24 months, so we can show that we handled it, and then delete it.

Server logs and technical information. Netlify keeps server logs for a limited period under its own retention practices, and we don't keep separate copies of them. Technical information recorded with a form submission is deleted along with the submission. Google keeps the information it processes for reCAPTCHA under its own retention practices; we never receive or store it.

8. Security

The website is served over an encrypted connection (HTTPS), so the information you type into the contact form is encrypted while it travels to Netlify's servers. The contact form uses Google reCAPTCHA and Netlify's spam filtering to block automated abuse. Form submissions are stored in Netlify's systems, which we reach through an account limited to the people who run our business. Netlify describes its own security practices at its Trust Center, linked in Section 4.

No website or storage system is perfectly secure, and we can't promise that your information will never be affected by a security incident. That is one reason we ask you not to send sensitive information through the form, and one reason we delete messages after 12 months. If you believe your information has been exposed through our website, please tell us using the contact form.

9. Your California privacy rights

California's main consumer privacy law, the California Consumer Privacy Act (CCPA), applies to businesses above certain size thresholds based on annual revenue or the volume of personal information they handle. We are a small company and don't currently meet those thresholds, so the CCPA's requirements don't apply to us.

We have chosen to offer these choices anyway, to everyone who contacts us, wherever you live:

• Know. You can ask what personal information we have about you, where we got it, how we use it, and who we have shared it with. We'll give you a copy.
• Correct. You can ask us to fix information that is inaccurate.
• Delete. You can ask us to delete your information. We'll do so unless we need to keep it for one of the reasons in Section 7, and we'll tell you if that is the case.
• No retaliation. We'll never treat you differently for making a privacy request.

Because we don't sell or share personal information for advertising, and don't intentionally collect sensitive personal information, there is no "Do Not Sell or Share" or "Limit the Use of My Sensitive Personal Information" choice to make here.

How to make a request. Use the contact form on the website, choose Privacy Request as the inquiry category, and tell us what you'd like us to do. If you can, use the same email address you used when you first contacted us.

How we verify requests. The only personal information we hold about website visitors is what they sent through the contact form. To make sure we're talking to the right person, we'll match the email address on your request to the one in our records, and we may reply to that address to confirm before we act. We won't ask you for more information than we need.

How long we take. We'll respond within 45 days of receiving your request. If we need more time because a request is complicated, we'll tell you why and when to expect our answer.

If you're not satisfied. You can write to us again through the contact form. California residents can also contact the California Attorney General (https://oag.ca.gov/privacy) or the California Privacy Protection Agency (https://cppa.ca.gov/).

10. Children's privacy

Our website is for adults: professionals, clients, and students interested in our work. It isn't directed to children, and we don't knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe a child under 13 has sent us information through the contact form, please tell us using the form and we'll delete it.

11. Visitors outside the United States

We operate from California, and the information you send us through the website is stored and processed in the United States, by us and by Netlify. Netlify delivers the website from servers around the world, so technical information about your visit may pass through servers in other countries before being processed in the United States. Google may process the information used for the reCAPTCHA spam check in the United States or in other countries where Google operates.

United States privacy laws may differ from those in your country. If you are outside the United States, please keep this in mind before sending information through the contact form. The choices described in Section 9, to know, correct, and delete your information, are available to you no matter where you live. If you have questions about how we handle information from your country, ask us through the contact form.

12. Changes to this policy

We'll update this policy when our practices change, for example if we add a new service provider, start using analytics, or change how long we keep information. When we do, we'll post the new version on this page and update the effective date at the top.

If a change is material, meaning it would make us handle your information in a way you wouldn't expect from the current policy, we'll also post a notice on the website's home page for at least 30 days. If the change affects information you have already sent us and we have your email address, we'll email you about it.

13. How to contact us and make a privacy request

Bay Area Flux and Magnetism, LLC is a California limited liability company based in the San Francisco Bay Area.

The best way to reach us about anything in this policy is the contact form on this website:

• Choose Privacy Request to exercise the choices described in Section 9 or to ask how we handle your information.
• Choose General Inquiry for anything else.

We read every message and will reply to privacy requests within the time described in Section 9.