External links
Links to project sites or other services lead to systems with their own privacy practices. A link is not a claim that Charles controls that service or its data.
Public notice / Current implementation state
Privacy,
without fog.
Owner and legal review pending
This is an operational notice for the site as it exists now. It is not the final policy for future contact, analytics, subscriptions, accounts, or commerce.
Static first.
Data minimal.
CharlesMorris.org publishes static public pages with one runtime-gated contact route. The contact fields can prepare a plain-text briefing note locally, but the send control remains locked unless a same-origin endpoint confirms that private delivery and abuse controls are configured.
Downloading a briefing note creates the file in browser memory and sends no form value to this site. The page does not save the draft in local storage.
The RSS feed exposes the same public updates available on this site. It does not require an account, email address, cookie, or site-owned subscriber record.
The site does not currently implement advertising trackers or a first-party analytics script. That statement will be revised before any such service is activated.
- 01Contact form
- Runtime-gated / locked without private configuration
- 02Local briefing download
- Available / browser memory only
- 03Newsletter or account
- Inactive
- 04RSS feed
- Available / no account
- 05Checkout and payment
- Inactive
- 06Advertising trackers
- Not implemented
- 07Analytics
- Not implemented
- 08Necessary contact cookie
- Issued only when delivery is active
Ordinary web delivery
Hosting records may still exist.
As with most websites, the hosting and network providers may process request data such as an IP address, browser or device information, requested URL, request time, and security events to deliver and protect the site.
If contact delivery is active, the endpoint uses the request address to enforce a short abuse limit. It writes only a keyed one-way address digest, attempt count, and rolling-window time to private rate-limit storage; expired windows are removed during later requests.
The exact providers, processing roles, locations, and retention periods have not yet been approved for publication. Those details remain pending verification.
Contact
When the page explicitly reports that private delivery is active and a visitor chooses Send, the endpoint receives the selected route, name, email, optional organization, message, privacy acknowledgement, and anti-abuse fields. It sends the inquiry to a private configured mailbox and does not create a site-owned inquiry database.
Commerce
Checkout, order records, entitlements, and downloads are inactive. A complete commerce notice will precede any transaction.
Cookies
An active contact endpoint issues one Secure, HttpOnly, SameSite=Strict cookie to bind the form to the same browser for up to two hours. It is used only for request security, not advertising or analytics. No optional cookie feature is implemented, so no consent banner is shown.
Pending before activation
No invented
legal details.
Controller contact pending
The verified privacy contact, legal identity or address, applicable jurisdiction, rights-request process, mailbox retention practice, and final effective date are not yet approved. This page will not manufacture them. Production delivery must remain locked until those activation inputs are reviewed.
Material changes will be reflected here with a new review date before affected features are activated.