Security

What this website does with your information, in plain English.

This page describes doyel-labs.com itself. Every line here is backed by the code that runs the site. If something changes, this page changes the same day.

When you visit

What we count when you visit, and what we don't.

We do measure traffic, and we'd rather tell you exactly how than pretend we don't.

Cookieless analytics

Cloudflare Web Analytics counts page views, referrers, and broad browser and device categories. No cookies, no persistent identifier, no session recording. If your browser blocks it, nothing breaks.

Approximate location counts

We keep hourly counts of visits by country, region, and city, using the approximate location Cloudflare attaches to the request. Nothing about you is stored with it: no IP address, no page path, no identifier. Do Not Track and Global Privacy Control are honored, and the counts are deleted after about 31 days.

Static files over HTTPS

Every page is a static file served by Cloudflare with strict security headers: HSTS, no framing, and a content-security policy that only allows scripts from this site, the analytics provider, and Cloudflare Turnstile.

The full wording, including retention periods and what the provider itself receives, is in the privacy policy. It is generated from the same configuration the site is built with, so it can't drift from reality.

When you send the form

Where your message goes, step by step.

The contact form is the one place this site takes information from you. Here is exactly what happens to it.

Step 1: It must come from here

The message has to be JSON sent from doyel-labs.com, not from another website, and stay under 16 KB. Anything else is refused before it is read.

Step 2: A person check

A Cloudflare Turnstile check confirms you're a person. On this site and on every preview deployment, if the check can't run, the form refuses to send rather than sending unchecked. In production the check only accepts a token minted for doyel-labs.com.

Step 3: A limit per network and per email

A limit on messages per network address and per email address stops floods. The email is kept only as a hash. The limit counts only after the person check, so bots can't use up your allowance.

Step 4: Emailed to a person

The message is emailed to [email protected] through Resend, a mail-delivery service, and lands in a Google Workspace mailbox. You get one short automatic receipt that doesn't repeat what you wrote. Nothing is written to a database.

Step 5: Kept only as needed

It stays in that mailbox as long as needed to reply and work together. If something fails, the error you see never includes internal details.

Processors: Cloudflare (hosting, Turnstile, analytics) · Resend (email delivery) · Google Workspace (mailbox) · Cloudflare Web Analytics

What we don't do

Three things this site will never add.

No session replay, ever

No tools that record your screen, your mouse, or what you type. Not now, not later.

No ad pixels or retargeting

Nothing here tells an ad network you visited. You won't see us following you around the web.

No selling or sharing form data

What you write in the contact form goes to Doyel Labs and stays there. It is not sold, shared, or added to a list.

Reporting a problem

Found something wrong? Tell a person.

Email [email protected] with what you found and how to reproduce it. A person reads it. The machine-readable policy is at /.well-known/security.txt. We thank reporters, and we don't pursue good-faith research.

The site's source is public on GitHub: github.com/Doyel-Labs-LLC/doyel-labs-com

Questions

Ask a person about any of this.

If a line on this page isn't clear, or you want to know how we'd handle your own site, call or write. A person answers.

Call (307) 429-0389

Mon–Fri, 9–6 Mountain · A person replies within one business day