niallbell.com Stats

Global Privacy Control (GPC) is a modern web standard that allows you to set a single, global preference in your browser to opt-out of tracking and data selling across all websites you visit.

I have technically configured this site to detect and honor GPC signals. If you have it enabled, you'll see a green "Active" confirmation in the card at the top of this page.

Learn how to enable GPC →

How I count visitors

When you load a page, a single request logs the URL and page title to a SQLite database I own and control entirely, hosted on Val.town, a small, independent developer platform. That's it. No data is stored beyond the URL, title, and timestamp. No IP address, no fingerprint, no cookies.

The site activity data is fully public. I don't look at anything you can't see yourself. There are no third-party data companies, no ad platforms, and no data sharing.

View Site Activity →

Why I count visitors

This site is a place for my photography, writing, and projects. Knowing which pages and galleries people visit most helps me understand what work is resonating — whether that's a particular wildlife gallery, a blog post, or a set of prints. It informs what I spend time creating and improving, without me needing to know anything about who you are.

Form Submissions

When you use the enquiry forms on this site (such as for photo prints), the information you provide is sent to me via Web3Forms. This is a technical intermediary that allows me to receive your messages without running a complex database-driven backend. They do not sell your data, and your information is only used for the purpose of responding to your specific request.

Client Galleries

I sometimes share a private, password-protected gallery with a client so they can choose their favourite photos. On those pages you can tap a heart on any photo to shortlist it. Your hearts are saved only in your own browser (using local storage, not cookies), as a simple list of the photos you picked, so you can come back later and change your mind. They are never sent anywhere until you choose to send them.

The password you type is also kept in your browser, but only until you close the tab, so reloading the page doesn't ask for it again.

When you press Send Picks, your chosen photos, the gallery's address and any message you add are emailed to me through Web3Forms. I don't ask for your name or email address there. Client galleries also don't log visits, so they never appear in the site activity.

To clear your hearts, tap them again, or clear this site's data in your browser settings.

Anti-AI Scraping

In addition to human privacy, I also value the integrity of my creative work. This site employs meta tags and headers to signal to AI crawlers that my content and photography should not be used for model training without my explicit permission.

Content Security Policy

A Content Security Policy (CSP) is a browser instruction that restricts what resources a page is allowed to load and where it can send data — a meaningful defence against cross-site scripting and data injection attacks. This site has a CSP implemented via a meta tag, plus a frame-ancestors rule sent as an HTTP response header.

The following directives are active:

• base-uri 'self' — prevents attackers injecting a <base> tag to hijack relative URLs.
• form-action 'self' https://api.web3forms.com — forms can only submit to this site or the trusted contact form handler.
• connect-src — restricts fetch/XHR requests to only the trusted endpoints this site uses: Web3Forms, Val.town, jsDelivr (CesiumJS assets), CARTO, and Esri (map tiles).
• frame-src — embedded iframes are limited to YouTube, Vimeo, and Kuula.
• frame-ancestors 'self' (clickjacking protection) — other websites cannot embed this site in a frame. This only works as an HTTP response header, so it is sent by the host (Cloudflare Pages) rather than the meta tag, alongside X-Frame-Options for older browsers.
• Strict-Transport-Security (HSTS) — tells browsers to only ever connect to this site over HTTPS.

Two common CSP recommendations are not implemented yet, for practical reasons:

• Removing 'unsafe-inline' — many page features (galleries, maps, interactive elements) currently rely on inline scripts embedded directly in the HTML templates. Removing 'unsafe-inline' requires consolidating these into external script files, which is an active work in progress. Once complete, this will be removed from the policy.
• 'unsafe-eval' and 'wasm-unsafe-eval' — the CesiumJS library that powers the Photo Map uses WebAssembly and code evaluation internally, which requires these directives. They are necessary for the 3D globe to function and only affect the map page.

Data Transparency

A "Zero-Tracking" site doesn't mean zero network requests. To provide a rich experience, this site communicates with a few trusted external services. You can verify these in your browser's "Network" tab at any time:

• Cloudflare: Hosts and serves this site. Like any web host, it handles the network connection, so it sees your IP address in order to deliver the page; I don't receive or store it. Data sent: Every page request. No cookies.
• Imgur: Hosts high-resolution photography. Data sent: Request for image file. No cookies.
• CARTO (CartoCDN): Provides label overlay tiles on the Photo Map. Data sent: Request for map tile images. No cookies.
• Esri / ArcGIS Online: Provides satellite imagery on the Photo Map. Data sent: Request for map tile images. No cookies.
• jsDelivr (cdn.jsdelivr.net): Serves the CesiumJS library that powers the 3D globe on the Photo Map. Data sent: Request for script and asset files. No cookies.
• Val.town: Logs page visits. Data sent: Page URL, page title, and timestamp. No IP, no cookies, no third-party access.
• Web3Forms: Transmits enquiry messages and client gallery picks. Data sent: Form entries only on submission.
• Amazon Media: Serves book covers. Data sent: Request for image file. No cookies.

Your Data Rights

Under modern privacy laws (like GDPR and CCPA), you have rights regarding your personal data. Because I don't use cookies, trackers, or account systems, for the vast majority of visitors, I hold no data to access, export, or delete.

However, if you have used one of my enquiry forms, I will have the information you explicitly shared (such as your name, email, message, or the photos you picked in a client gallery) in my inbox. At any time, you have the right to:

• Request a copy of the communication you sent me.
• Request that I delete our email history and your contact details.
• Correct any information you previously provided.

To exercise any of these rights, simply email me at (click to reveal email) and I will handle your request promptly.

Don't take my word for it

I believe privacy claims should be independently verified so I invite you to audit this site using these respected 3rd party tools:

Note: some audit tools will still flag 'unsafe-inline' in the Content Security Policy — see the section above for why it is there and the work in progress to remove it.

Questions?

I am committed to maintaining a site that respects your digital rights. If you have any questions about how your data is handled, or if you'd like to suggest improvements to my transparency report, please email me at (click to reveal email). I'm always happy to chat about the open web and digital privacy.