Privacy Policy

Who's responsible (data controller)

The data controller for this site is John Bradshaw, acting in a personal capacity, based in the United Kingdom. This site is a personal site — not an Akamai site — so Akamai Technologies is not the controller of any personal data processed here. See the Legal notice for context.

For any data-protection question or request, get in touch via the channels on the About page and mark your message as a privacy request.

What data the site collects

The site is a static site — there are no user accounts, no comments, no login, and no contact form that stores your messages. Personal data is only collected in the following narrow ways:

1. Product analytics (PostHog)

The site uses PostHog for analytics, hosted in the EU. Requests are sent to the first-party subdomain t.bradshaw.cloud, which proxies PostHog's EU service. The analytics script is configured with PostHog's defaults: '2026-01-30' preset and exception tracking enabled (capture_exceptions: true).

That setup collects, on each page view:

• the URL of the page you visited and the referring URL;
• your browser, operating system, device type, and language;
• a coarse approximation of location derived from your IP address (typically country, region, and city); your full IP address is not stored by PostHog;
• autocaptured interaction events (clicks, form interactions, page-leave events) and basic web-vitals performance metrics;
• a randomly-generated identifier stored in a first-party cookie / local storage so repeat visits can be linked into a session.

On top of those defaults, the site emits a number of named custom events to understand which content and call-to-action buttons resonate. The current set includes:

• outbound_link_clicked — when you click a link to another site, with the destination URL, the link text (truncated), the section of the site you were on, and (if the link was inside a content card) the card's title and content type;
• share_clicked — when you use the share bar (X, LinkedIn, Bluesky, Email), with the channel, the URL being shared, and the page path;
• hero_cta_clicked — when you click a call-to-action button in the homepage hero, with the button label;
• contact_link_clicked — when you click one of the contact buttons on the About page (LinkedIn, Signal, X);
• speaking_cta_clicked, speaking_external_link_clicked, speaking_register_clicked, speaking_calendar_downloaded, speaking_recording_clicked — interactions on speaking pages, with the event slug, event title, and (where relevant) the type of link;
• media_external_link_clicked — when you click through to a media item hosted elsewhere, with the destination and media slug;
• newsletter_subscribed — when you submit the newsletter form (see below).

New CTA / link-click events of the same kind may be added as new content ships, following the same pattern: an event name, the page or component it fired from, and the URL or label involved — never your identity or any data you didn't submit.

Unhandled JavaScript exceptions and rejected promises are also captured automatically and sent to PostHog's error-tracking feature so production bugs can be diagnosed. Source maps are uploaded as part of deployment so stack traces can be de-minified. Error reports may include the URL where the error occurred, a stack trace, and the browser/device information already listed above.

Session replay, heatmaps, surveys, feature flags, and PostHog's identification of named individuals are not enabled.

2. Newsletter subscriptions (Buttondown)

If you submit the newsletter form, your email address is sent directly to Buttondown, the third-party service that runs the mailing list. The form opens Buttondown's own confirmation page in a new tab. Buttondown becomes the processor for your email address and any analytics data it captures about email opens, clicks, or unsubscribes; their practices are governed by Buttondown's own privacy policy.

We also fire the newsletter_subscribed analytics event in PostHog at the moment of submission so we know how many people signed up from a given page. That event does not include your email address.

You can unsubscribe from the newsletter at any time using the link in the footer of any email it sends.

3. Hosting and CDN logs

The site is served as static files from Linode Object Storage, fronted by the Akamai content-delivery network with Akamai EdgeWorkers handling certain edge logic (such as custom error pages). When you request a page, the CDN and origin storage receive standard HTTP request information — including your IP address, the URL requested, your user agent, and the referring URL — which is processed for the purposes of delivering content, operating the network, and protecting against abuse.

These logs are operated by Linode (an Akamai company) and Akamai respectively as processors. They are not used for site-level analytics and are not joined with the PostHog data described above.

Embedded third-party content

Some pages embed video players from YouTube (for recorded talks and interviews). When you load a page containing a YouTube embed, your browser connects directly to YouTube; YouTube may set cookies and process your data in line with Google's privacy policy, independently of this site. We use standard youtube.com/embed/… URLs and do not control what YouTube collects via that connection.

Share buttons on content pages link to X, LinkedIn, Bluesky, and your email client. They are plain links — they only contact those services if you click them.

What the site doesn't do

• It does not show advertising or share data with ad networks.
• It does not sell, rent, or trade any personal data.
• It does not record or replay your session.
• It does not run heatmaps or behavioural surveys.
• It does not track you across other websites you visit.
• It does not build a profile of you under a real-world identity (PostHog person profiles are not enabled).

Cookies and similar technologies

The only cookie / local-storage entry set directly by this site is the PostHog identifier described above, stored as a first-party item on the bradshaw.cloud domain. It is used to link page views into a single session for analytics purposes and is not used for advertising.

Embedded YouTube players may set their own cookies on the youtube.com domain when you interact with them. The site does not control those cookies.

Most browsers let you block or delete cookies and local-storage entries from their settings. PostHog also exposes a programmatic opt-out: running posthog.opt_out_capturing() from your browser's developer console disables analytics for the current browser. The site does not currently auto-honour Do Not Track or Global Privacy Control headers; if you'd like that added, please get in touch.

Legal basis for processing (UK GDPR / EU GDPR)

For visitors in the UK or the EEA:

• Analytics, error tracking, and the related first-party identifier are processed on the basis of our legitimate interest in understanding which content people find useful and in keeping the site working correctly. The processing is limited to what's necessary for those purposes, no profiles under a real-world identity are built, and you can opt out as described in the Your rights section below.
• Newsletter subscription is processed on the basis of your consent, given by submitting the form. You can withdraw consent at any time by unsubscribing.
• Hosting and CDN logs are processed on the basis of legitimate interest in delivering the site and protecting it from abuse, and (for security-related processing) the legitimate interest of network operators in maintaining service integrity.

How long data is kept

• Analytics events: retained in PostHog for as long as needed to spot trends in site usage — typically up to PostHog's default retention window. Aggregated data may be kept longer.
• Error-tracking data: typically retained for a shorter period sufficient to diagnose and fix bugs.
• Newsletter subscriber data: kept by Buttondown until you unsubscribe (or you ask for it to be deleted).
• Hosting and CDN logs: retained according to Linode's and Akamai's standard operational retention periods.

International transfers

PostHog data is processed on PostHog's EU infrastructure. Buttondown is based in the United States; when you subscribe to the newsletter, your email address is transferred to the US under the safeguards provided by Buttondown's terms (which typically include the EU Standard Contractual Clauses for any onward transfers from the UK / EEA). Akamai and Linode operate global networks; CDN edge nodes outside the UK / EEA may briefly process your request data to deliver content from the nearest location.

Your rights

If UK or EU data-protection law applies to you, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (where the legal basis allows);
• restrict or object to processing (including objecting to analytics processing carried out on the basis of legitimate interest);
• withdraw consent at any time, where consent is the legal basis;
• receive your data in a portable format, where applicable;
• complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ICO); in the EEA, the supervisory authority of the country where you live or work.

To exercise any of these rights, contact us via the channels on the About page. Because the site does not identify individual visitors by name, fulfilling an access or erasure request usually requires you to supply enough information for us to locate the relevant data (for example, the date range and approximate IP range you used, or the email address you subscribed with).

Children

This site is aimed at a professional adult audience and is not directed at children. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

Material changes to this Privacy Policy will be reflected by updating the "Last updated" date at the top of this page. If a change is significant — for example, the introduction of a new third-party service that collects personal data — we will try to flag it more prominently before it takes effect.