I built this site to be quiet and honest — no ad cookies, no profiling, no selling your data. I do count page views, in a way that keeps nothing on your device. Below is the fast version in bullets. Want the precise, lawyerly wording? It's the follow-up link under each part, and in full further down.
Last updated: 29 July 2026 · Applies to: joelbondoux.net, the sign-in at login.joelbondoux.net and the tools it opens (Prospector, Music Lab, AtlasMind, AppDeck), and the Action Items board
The precise version. Same facts as the bullets above, with the detail a legal document needs. Jump to what you need: Who I am · The public site · What's stored · Signed-in tools · Who else is involved · Your rights · Retention & security · Terms of use · Changes
This site is run by Joel Bondoux — an independent technical director and engineer based in Farnham, England (GU9), United Kingdom. For anything on this page, I'm the "data controller": the person who decides what data is collected and why, and the person you contact.
Because I'm based in the UK, this page follows the UK GDPR and the Data Protection Act 2018. Where a tool is used from elsewhere, the same principles are applied.
The public part of joelbondoux.net is a personal portfolio. It is deliberately minimal about data:
joelbondoux.net and its subdomains so the look follows you into the signed-in tools instead of resetting on each one, and it is mirrored in your browser's local storage. It holds the word light or dark and nothing else — no identifier, nothing that could track you. Details in §3.mailto: link. It opens your own email app with my address filled in — there's no web form, and nothing is sent anywhere until you send an email. When you do, I receive and keep it as ordinary correspondence (see §7).Lawful basis. Saving your theme preference and serving the pages you request rely on my legitimate interest in providing a working, accessible website (UK GDPR Art. 6(1)(f)); the theme setting is strictly functional and set only as a result of your own choice. Serving the site necessarily involves processing your IP address in transit and in short-lived server logs, again on the basis of legitimate interest in security and reliability. Aggregate measurement of which pages are read rests on the same legitimate interest; it produces counts, not records about you, and I have taken the deliberate decision to use a method that cannot identify you.
No consent banner is legally required for the public site. The consent rule in PECR / the ePrivacy Directive attaches to storing information on, or reading information from, your device. The public site stores only the theme setting, which is functional and set at your own request, and Cloudflare Web Analytics stores and reads nothing at all — it is cookieless and assigns no identifier, so there is nothing to consent to and nothing you could meaningfully refuse. It also performs no profiling and no cross-site tracking. The notice you may have seen is therefore provided for transparency, not because tracking is taking place. If I ever add measurement that stores something on your device, that profiles you, or that follows you between sites, the notice will become a genuine consent control and no such tracker will load before you opt in.
Here is the complete list of everything the site and its signed-in tools can store in your browser. None of it advertises to you or tracks you across the web — it's there to make things work. You can clear any of it at any time in your browser settings.
The visitor counting described in §2 adds nothing to this table, and that's the point: Cloudflare Web Analytics is cookieless. It writes nothing to your device and reads nothing from it, which is why there is no row for it below and nothing for you to clear.
| Name | Type | What it holds | Why | How long |
|---|---|---|---|---|
jb-theme |
Cookie + local storage | light or dark |
Remembers your appearance choice. The cookie is scoped to .joelbondoux.net so one choice covers the public site and every signed-in tool; local storage is a per-site mirror of the same word |
1 year (cookie); until cleared (local) |
jb-cookie-notice |
Local storage | A version tag of the notice you dismissed | So the privacy notice doesn't reappear every visit | Until you clear it |
sid |
Cookie (HttpOnly) signed-in | Your login session for login.joelbondoux.net and the tools it opens | One sign-in works across every tool (single sign-on) | Until you sign out or it expires |
local-music-lab |
IndexedDB Music Lab | Your Music Lab projects, recordings and sample kits | Keeps your work between sessions — it stays on your device and is never uploaded | Until you delete it |
sb-…-auth-token |
Local storage Action Items | Your login session for the Action Items board (from Supabase) | Keeps you signed in to that one board | Until you sign out or it expires |
| Stripe cookies | Cookie Prospector billing | Set by Stripe if you open a payment screen in Prospector | Secure payments and fraud prevention, handled by Stripe | Per Stripe's policy |
"Local storage" and "IndexedDB" are small stores in your browser that are not sent automatically to any server. Cookies are sent to the matching site. The only third-party cookies here are Stripe's, and only on Prospector's payment screens. If a new tool ever stores something, it's added to this table.
Some tools on the platform are private and open only after you sign in. One account — created at login.joelbondoux.net — works across all of them (single sign-on). Each tool below says exactly what it stores and why; as tools are added or changed, this list is kept in step.
Sign-in is by email and password, handled by my own identity service
(not a third-party login). Your password is never stored in readable
form — only a strong one-way hash (PBKDF2, 100,000 iterations, with a
per-account random salt). Your session is a random token, and even that
is kept only as a hash; your browser holds a single sid
cookie (see §3) so one sign-in opens every tool
you've been granted. Signing out ends it.
login.joelbondoux.net/account).Prospector scans freelance marketplaces and surfaces a ranked shortlist of opportunities for you to review. It never bids, applies or posts on your behalf.
Music Lab is a browser-based studio for composing and generating game music. It's deliberately local-first.
AtlasMind is an AI coding assistant that runs on my own desktop machine. This address is only a gateway: it checks your sign-in and then connects your browser through to that machine. It has no database of its own.
AppDeck (and its LookDesigner Pro module) is a separate application that opens with the same sign-in. It verifies your session with the account service above; it doesn't run its own login.
A private to-do board for things that need a human's hands. It's a standalone page with its own separate sign-in — it uses Supabase, not the account login above.
esm.sh code CDN when it opens — see §5.To run the site and its tools, a few trusted services process data on my behalf. They're listed here in full. None of them are given your data for advertising.
| Service | Role | What it sees | Where |
|---|---|---|---|
| Cloudflare cloudflare.com |
Hosting, database (D1), cache and network for the sign-in service, Prospector and Music Lab; also the private Tunnel that carries Music Lab and AtlasMind traffic to my own machines | Your IP and request details, your account record, and the tool data held in the database | Global network (US company) |
| Cloudflare Web Analytics same company, separate product |
Counts page views across the site so I can see what gets read. Enabled across the whole domain at Cloudflare's edge — it is not a script in the page source | The page viewed, the referring page, your browser and device type, an approximate country, and page-load timings. No cookies, nothing stored on your device, and no identifier — it cannot recognise a returning visitor or follow you to other sites | Global network (US company) |
| Anthropic (Claude) anthropic.com |
The default AI model that writes Prospector's listing summaries | The text of the listings you choose to review | US |
| Your own AI provider (optional) | Used only if you add your own key — OpenAI, Google (Gemini), Groq, or a model running locally in your browser | Only the prompts you send it | Varies / your device |
| Stripe stripe.com |
Payments for Prospector's paid features | Your card details go directly to Stripe; I keep only a customer reference and status | US / global |
| Freelancer.com & Remotive | The marketplaces Prospector scans for listings | Your search terms — sent from Cloudflare's servers, so they don't see your own IP | Global |
| jsDelivr jsdelivr.com |
Delivers up-to-date currency rates to Prospector (fetched server-side) | No personal data | Global CDN |
| Supabase supabase.com · Action Items only |
Database & sign-in for the Action Items board | That board's items, your email and a hashed password | EU — Ireland (eu-west-1) |
| esm.sh esm.sh · Action Items only |
Code CDN that delivers the Supabase library to your browser on the Action Items page | Your IP and browser type — but none of your data | Global CDN |
| Public-site host serves joelbondoux.net |
Serves the public marketing pages and files | Standard access logs: IP, browser type, timestamps | Global CDN / edge |
International transfers: some of these providers (Cloudflare, Anthropic, Stripe) are US-based with global networks, so using the tools can involve transferring data outside the UK/EEA. Where that happens it's under appropriate safeguards, such as the UK's International Data Transfer Agreement or the EU Standard Contractual Clauses. The Action Items board's data is stored in the EU (Ireland).
Under UK data protection law you can ask me to:
To do any of these, email hello@joelbondoux.net. There's no charge, and I'll respond within one month. If you're not happy with how I've handled your data, you can complain to the UK's Information Commissioner's Office (ico.org.uk) — though I'd appreciate the chance to put it right first.
This is a professional portfolio and set of private tools. It isn't directed at children, and I don't knowingly collect data from anyone under the age of 13. If you believe a child has provided data, email me and I'll remove it.
The plain version:
Intellectual property. All content and code presented on joelbondoux.net is owned by Joel Bondoux or used with permission and is protected by copyright and other laws. You may view it and link to it for personal, non-commercial reference. You may not copy, reproduce, republish, or create derivative works from it without prior written permission.
Tools & availability. The signed-in tools are made available at my discretion for authorised account holders. They are provided "as is" and "as available", without warranties of any kind, express or implied. To the fullest extent permitted by law, I accept no liability for any loss or damage arising from their use or unavailability. Access may be suspended or terminated at any time.
Acceptable use. You agree not to use the site or its tools unlawfully, or to attempt to gain unauthorised access, interfere with their operation, or misuse any credentials or data.
Governing law. These terms and any dispute relating to them are governed by the laws of England and Wales, and are subject to the exclusive jurisdiction of the courts of England and Wales.
When the site changes what it stores or offers, this page is updated in the same breath — that's a rule I've written into the file itself. The "last updated" date at the top always reflects the current version. If a change is significant, the privacy notice may reappear so you see it once more.
.joelbondoux.net as well as local storage, so it carries into the signed-in tools instead of resetting on each subdomain. §3 always described it as "Cookie + local storage"; §2 wrongly said the public site set no cookies at all. The code now matches §3 and §2 has been corrected. Nothing new is collected — the cookie holds only the word light or dark.