What this site stores.

Browsing

The public pages do not ask you to create an account. This build does not run an advertising or analytics tracker, and it does not sell information.

Typefaces are included with the site. The browser is not sent to a font service to read the pages.

The project form

If you submit a project request, we store the fields on that form: your name, business name, email, phone if you add one, current website if you add one, the kind of work, timing, an optional budget note in your own words, the summary, that you gave consent, a status, and the time it was saved. A hidden field is used to reject automated submissions and is not kept when it is filled.

The request is stored in a SQLite database on the server, outside the public site files, so the agency can read it and reply. It is not published. People who can read that database, and an operator signed in to the private desk, can see it.

Acknowledgement email

If email delivery is configured, we send one acknowledgement to the address you submitted. The message is fixed text plus a reference number we created. It does not include your summary, your website, or other text you typed. The provider is whichever sender is configured on the server, either Resend or an SMTP host. That provider receives the recipient address, the fixed message, and the reference.

If delivery is not configured, no acknowledgement is sent, and the receipt says so. A failed send is recorded as failed and is not described as sent. We keep the acknowledgement status, a short error code, an attempt count, and times. We do not keep a copy of a provider’s raw error page.

Rate limits and the desk

Inside the application, repeated submissions and sign-in attempts are slowed with a hash of a connection address, a counter, and a time window. That application record does not keep the address itself. It is separate from the web server logs described below, which do keep IP addresses.

The private desk can also store leads, notes, outreach drafts, and demo-job records that an operator enters. Those records are not part of the public form and are not published. This page does not describe a separate product that collects them from the open web. Nothing is scraped by this site.

Web server logs

The web server in front of this site writes access logs and error logs for ordinary operation. Those logs are not the hashed rate-limit records in the application database. A standard access log line includes the visitor’s IP address, the time of the request, the requested URL, the response status, and the browser user agent. An error log can include the same kind of request detail plus the server’s error text.

We use those logs to keep the site up, to investigate abuse and faults, and to troubleshoot a failed request. They are not an advertising profile, and this application does not copy them into the project-request database.

How long the web server keeps those files is not configured by this application. This page does not state a fixed log retention period, and it does not promise that the logs are deleted automatically.

Cookies

Reading the public pages does not set a marketing cookie and does not require a cookie banner for a tracker, because no tracker is installed.

After an operator signs in to the private desk, the server sets one essential session cookie, httpOnly and SameSite strict. Its name is arove_session, or __Host-arove_session when the secure flag is on. It identifies that sign-in. It expires after twelve hours and is not used for advertising. Visitors who only use the public pages do not receive it.

How long it is kept

Project requests and desk records stay until the agency deletes them. This site does not run an automatic deletion job for those records, and this page does not promise one. Session rows expire after twelve hours. Hashed rate-limit rows are only useful for their short window. Web server access and error logs, which contain IP addresses, follow the server’s own log settings. Those settings are not configured here, so this page does not give them an expiry date.

Asking about your request

Use the project form. Start the summary with “Privacy request”, include the reference number if you have one, and use an email address where we can reply. There is no separate privacy mailbox, and sending the form does not by itself mean a person is watching a different inbox.

We have not published a legal entity, a postal address, or a supervisory authority, because those details have not been supplied. If a request needs a formal controller or a local filing, those facts have to be added before this notice can name them.