Privacy

This page states what the bluesealine.co website collects, where it goes, how long it is kept, and what the site itself is able to read back. It covers the public website and the two forms on it.

It does not describe the case engine, which is not open yet. A separate statement is published before any case is opened.

The page is short because the site does very little. That is a design decision, and the clauses below say exactly how little.

No cookies are set on this website. Not a session cookie, not an analytics cookie, not a preference cookie, and nothing stored in the browser under any other name.

This is why there is no consent banner. There is nothing to consent to. The site cannot follow a visitor between pages, cannot build a profile, and cannot recognise anyone who returns.

Language is carried in the address rather than in a cookie, so reading one page in one language and the next in another leaves nothing behind.

Every file this site serves comes from bluesealine.co. There are no third-party fonts, no analytics scripts, no tag managers, no maps, no embedded video, no chat widget, and no advertising or social buttons.

The consequence is that visiting this site discloses nothing about the visitor to any third party, because there is no third party in the request. A content security policy served with every page instructs the browser to refuse anything from elsewhere.

The enquiry form and the listing form collect a name, a company, an email address, a telephone number if one is given, a registry division if one is chosen, and the message written into the form.

Nothing else is asked for, and nothing else is taken from the browser. All of it is supplied deliberately by the person sending it, and all of it exists to answer the enquiry.

The internet address a submission arrives from is not written down. What is written down is a salted SHA-256 hash of it, which cannot be turned back into the address it was made from.

That hash exists for one purpose: to count submissions from the same source so the forms can be rate-limited against abuse. It is not used to identify anyone and it is not combined with anything else.

A submission is written to one table in one database and emailed to the operator so that somebody reads it. There is no third destination.

It is not passed to an advertising network, a data broker, an analytics service or a customer-relationship product, because the site is connected to none of them.

This is the strongest statement on the page, and it is enforced by the database rather than promised by the code.

The account the website runs as may insert a row into the enquiries table. That is its only permission. It cannot read a name, an email address or a message back out, it cannot count the rows, and it cannot change or delete one. The database refuses the attempt; the application is not merely choosing not to make it. The reference shown after you send something is generated before the row is written, so that even returning it requires no read.

There is therefore no page, no address, no administrator screen and no flaw in this website that can be used to read enquiries back out of it, because the permission required to do so was never granted. Reading the archive means signing in to the hosting account directly as the operator. This was not assumed: when the account was created, selecting, counting, updating, deleting, truncating, creating, dropping and altering were each attempted against the live database, and each was refused.

Submissions are held on a single server operated for Bluesealine, together with the mailbox the notification is sent to. That infrastructure is not shared with another product.

An enquiry is kept for as long as it takes to answer it, and afterwards as a record of business correspondence.

It is not kept in order to be marketed to, and it is not kept in order to be analysed. A request to delete it is acted on, and the clause below says how to make one.

Anyone who has sent something through a form on this site may ask what was submitted, ask for it to be corrected, or ask for it to be deleted.

Write to hello@bluesealine.co, either from the address used in the form or naming the address that was used, so the right record is found.

There is no self-service screen for this, and there will not be one while the website is unable to read the table. The request is handled by the operator directly.

This statement describes the software as it is deployed. If the software changes, this page changes in the same release, and the document date at the head of the page changes with it.