Unattended Works

Launching soon

Unattended Works · Privacy

Privacy

This site collects nothing. Not "collects nothing important" — there is no analytics script, no cookie, no third-party script, and no address to hand over. The public audit route at /demo/ reaches only our first-party API, and only in response to the proof, test-checkout, status, or recovery action you take.

The contract

What this site does not do

  • No analytics

    No analytics product, first-party or otherwise, is loaded or self-hosted.

  • No third-party scripts

    Every script, style, image, and font served here comes from this domain. There are no CDN, tag-manager, or embed requests.

  • No cookies

    This site sets no cookies and writes nothing to localStorage or sessionStorage. There is no consent banner because there is nothing to consent to.

  • No external fonts

    Typography uses fonts already present on your device. No font file is requested from anywhere.

  • No accounts or email capture

    There is no login or waitlist. Public intake at /demo/ accepts an admitted URL, ownership proof, Stripe test checkout, and a recovery receipt without collecting an identity or email address.

  • No fingerprinting

    The JavaScript on ordinary pages expands and collapses a disclosure list and nothing else. It reads no device characteristics, stores nothing, and sends no request. The demo route's script sends what you typed and nothing about your device.

What this site does

It serves static files. When your browser requests a page, the web server necessarily processes that request — which means, as with any website, an originating IP address and a user-agent string pass through the hosting provider’s infrastructure in order for the response to reach you. Unattended Works does not add to that, does not aggregate it into profiles, and does not attach any identifier to it.

There is no mechanism on this site that could associate two visits with each other.

What products will do

The audit product is not live. When it is, this page will be updated before it opens, in the same commit, with the specifics: what a buyer supplies, what is retained, for how long, and how to have it deleted. The commitments already made and recorded in the repository are:

  • A report contains no analytics, no beacons, and no external requests. It opens with the network switched off.
  • Audit output belongs to the buyer. It is not aggregated, benchmarked, resold, published, or used as case-study or training material.
  • The audit runner never authenticates, never submits a form, and never makes a state-changing request against an audited site.

If any of those change, the change is published in the launch log rather than edited in silently.

The public audit route

One route, /demo/, is the no-account public path through the audit product. It is the only page on this site with a control that reaches the network, and it does so only after you press its button. What happens then, precisely:

  • The URL is sent to our own API. The API accepts only pre-admitted HTTPS hosts and requires a short-lived DNS ownership proof before creating an order.
  • Stripe checkout is test mode only. No live charge can be made. The server authorizes first and captures only after a complete package passes integrity checks.
  • Status uses a signed, short-lived, resource-bound token that is also checked against server-side state. The recovery code restores access without a rerun; only its SHA-256 digest is stored.
  • No cookie is set, by this site or by the API. Nothing is written to localStorage or sessionStorage. Closing the tab discards active credentials, so the visitor must save the displayed recovery receipt.
  • The demo API is first party. The origin it runs on is fixed when this site is built and is named in that page’s own Content-Security-Policy, so the browser itself refuses any other destination.
  • A completed run produces a report package held for 30 days and reachable through a signed link valid for 7 days. After the retention window the package and every captured artifact are deleted; the record that a run happened is kept without them.
  • Runs are only permitted against hosts that deployment was configured to audit. The demo cannot be pointed at an arbitrary site.

Until this build has a demo API configured, that page renders with no form at all and requests nothing, exactly like every other page here.

Contacting us about this

There is no published email address on this site yet, because there is no support channel behind one. When a real role-based address exists it will be published here and recorded in the launch log. Until then, the honest position is that this site is not a way to reach a person.

Changes

This page is versioned in the repository that builds this site. Its history is the change log.