What this site knows about you
A short, honest account of what nodetwo.io collects, who else touches it, and how to make it stop.
Who I am
NodeTwo is the independent consulting practice of Jordan Dunn. I run this site myself, and I am the only person who reads what you send through it. You can reach me at [email protected]. That address is also how you ask me to delete something, or ask anything else on this page.
What this site collects
Every page here is a static page. There are no accounts, no logins, and no comments. The fonts are served from this site, so reading a page sends no request to a font provider. Five things do collect data, and each one is listed below.
The contact form
When you send the form on the contact page, I receive four things: your name, your email address, the subject you pick from the list, and your message. The form hands that to SMTP2GO, an email delivery provider, which delivers it to my inbox as an ordinary email. Your address is set as the reply address so that I can answer you.
I use what you send to reply, and to do the work you ask for. I do not sell it, and I do not add you to a mailing list. Your message sits in my email while it is useful to that work. If you want it deleted, email me and I will delete it.
The bot check
The contact form runs Cloudflare Turnstile to confirm that a person, not a bot, is sending it. Cloudflare processes technical signals from your browser for that check, and the form passes your IP address to Cloudflare along with it. Turnstile guards the form only; it does nothing on the rest of the site.
Hosting
The site is served by Cloudflare Pages. Cloudflare processes your IP address and your request data to deliver the site and to protect it from attack. That happens on every page, whether or not you use the form.
Analytics
Google Tag Manager loads Google Analytics 4 on the published site. Analytics records page views, scrolling, clicks on links that leave the site, file downloads, and clicks on email and contact links.
When the contact form sends successfully, the page reports one extra event. It carries three things: that a lead came from the contact form, which subject category you chose, and whether an in-browser AI agent filled the form. When a send fails, the page reports the kind of failure instead — a rejected field, a server problem, or a network problem — and the same agent flag. Neither event ever carries your name, your email address, or your message.
Session insights
I use Microsoft Clarity to capture how you use and interact with this site through behavioral metrics, heatmaps, and session replay. I use that to find what is confusing and to improve the site. Clarity captures usage data with first- and third-party cookies and other tracking technologies. In practice it records mouse movement, clicks, and scrolling, and it masks the content of sensitive inputs by default. For more, read the Microsoft Privacy Statement.
Cookies and consent
I set no cookies of my own. I do keep one entry in your browser's local storage, under the key , and it holds only your analytics choice and the date you made it. The cookies below belong to the analytics tags, and Cloudflare may set its own cookies to protect the site. The analytics tags load only on the published site, so they are absent from local and preview builds.
Advertising storage, advertising user data, and ad personalization are denied for every visitor, everywhere. This site runs no ads.
If you are in the EEA, the UK, or Switzerland, analytics storage is denied by default. Google Analytics then sets no cookies and sends cookieless pings only, and Microsoft Clarity does not load. Everywhere else, analytics storage is on by default and these cookies may be set:
- Google Analytics — Tells repeat visits apart and groups page views into one session.
- Microsoft Clarity — Ties a recorded session to a returning browser.
A consent banner asks about analytics. It appears by itself only for visitors in the regions where analytics is denied by default, because those are the visitors who have to grant it before anything is set. It offers two equal buttons, accept or decline, and nothing is pre-selected. To decide which visitors see it, the page asks my own endpoint once per browser session for a yes or no, and keeps that answer in session storage until you close the tab. That endpoint reads the country Cloudflare already attaches to your request, answers with a single true or false, and stores, logs, and returns nothing else.
Everyone can reach the banner at any time: the "Cookie settings" button in the footer reopens it and shows your current choice, so you can opt out even if it never appeared on its own. If your browser sends the Global Privacy Control signal, I treat that as a decline and never ask.
Your choice is kept in this browser's local storage, under the key , for up to 12 months. It never leaves your browser. After that, or on a different browser, or if you clear your site data, the question comes back. Declining also clears the analytics cookies listed above.
You can opt out anyway. Install the Google Analytics Opt-out Browser Add-on, block or clear cookies in your browser settings, or use a content blocker. None of that breaks the site.
AI agents and the contact form
The contact form is built so that an AI agent running in your browser can fill it for you as a tool call. The agent cannot send it by itself: you review the filled form and press the send button. I receive exactly the same four fields either way, and the analytics event records only that an agent was involved.
Who else receives your data
Four providers process data on my behalf. They may process it in the United States and in other countries. No one else receives it.
- Hosting, and the Turnstile bot check on the contact form — privacy policy
- Delivers the contact form to my inbox as email — privacy policy
- Tag Manager and Analytics 4 — privacy policy
- Clarity heatmaps and session replay — privacy policy
Your rights
Depending on where you live, you may have rights over your personal data — under the GDPR, the UK GDPR, the Swiss FADP, or a US state law such as the CCPA. Those usually include asking for a copy of what I hold, correcting it, deleting it, or objecting to how it is used.
Email [email protected] and tell me what you want. I handle these requests myself. I do not sell personal information, and I do not share it for advertising.
Children
This site is for businesses. It is not directed at children, and I do not knowingly collect personal data from them.
Changes to this page
When what the site does changes, I update this page and set a new effective date at the top. That date tells you which version you are reading.
Questions about any of this?
Ask me directly. I would rather answer than have you guess.