Unattended Works · Privacy
Privacy
This site collects nothing. Not "collects nothing important" — there is no analytics script, no cookie, no third-party request, no public form, and no address to hand over. One route, the private demo at /demo/, has a form that reaches our own API, and only once you submit it.
The contract
What this site does not do
No analytics
No analytics product, first-party or otherwise, is loaded or self-hosted.
No third-party scripts
Every script, style, image, and font served here comes from this domain. There are no CDN, tag-manager, or embed requests.
No cookies
This site sets no cookies and writes nothing to localStorage or sessionStorage. There is no consent banner because there is nothing to consent to.
No external fonts
Typography uses fonts already present on your device. No font file is requested from anywhere.
No public form, no accounts
There is no login, no waitlist, and no public intake. The private demo at /demo/ carries the only form on this site: it is inert without an admin code you already hold, and it sends what you type only when you press the button.
No fingerprinting
The JavaScript on ordinary pages expands and collapses a disclosure list and nothing else. It reads no device characteristics, stores nothing, and sends no request. The demo route's script sends what you typed and nothing about your device.
What this site does
It serves static files. When your browser requests a page, the web server necessarily processes that request — which means, as with any website, an originating IP address and a user-agent string pass through the hosting provider’s infrastructure in order for the response to reach you. Unattended Works does not add to that, does not aggregate it into profiles, and does not attach any identifier to it.
There is no mechanism on this site that could associate two visits with each other.
What products will do
The audit product is not live. When it is, this page will be updated before it opens, in the same commit, with the specifics: what a buyer supplies, what is retained, for how long, and how to have it deleted. The commitments already made and recorded in the repository are:
- A report contains no analytics, no beacons, and no external requests. It opens with the network switched off.
- Audit output belongs to the buyer. It is not aggregated, benchmarked, resold, published, or used as case-study or training material.
- The audit runner never authenticates, never submits a form, and never makes a state-changing request against an audited site.
If any of those change, the change is published in the launch log rather than edited in silently.
The private demo route
One route, /demo/, is a code-gated demonstration of the audit product. It is
the only page on this site with a control that reaches the network, and it does
so only after you press its button. What happens then, precisely:
- The URL you typed and the admin code you typed are sent, once, to our own demo API. The code travels in a request header, is compared against the configured value, and is then discarded. It is never written to the API’s database and never written to its request log.
- No cookie is set, by this site or by the API. Nothing is written to localStorage or sessionStorage. Closing the tab discards the code.
- The demo API is first party. The origin it runs on is fixed when this site is built and is named in that page’s own Content-Security-Policy, so the browser itself refuses any other destination.
- A completed run produces a report package held for 30 days and reachable through a signed link valid for 7 days. After the retention window the package and every captured artifact are deleted; the record that a run happened is kept without them.
- Runs are only permitted against hosts that deployment was configured to audit. The demo cannot be pointed at an arbitrary site.
Until this build has a demo API configured, that page renders with no form at all and requests nothing, exactly like every other page here.
Contacting us about this
There is no published email address on this site yet, because there is no support channel behind one. When a real role-based address exists it will be published here and recorded in the launch log. Until then, the honest position is that this site is not a way to reach a person.
Changes
This page is versioned in the repository that builds this site. Its history is the change log.