What it is
Plain HTML files, generated ahead of time and served by nginx from a container. No PHP, no database, no content management system, no application running behind these pages. The server opens a file and sends it.
What it stores, and what it sends
Nothing, and nothing. No cookies are set and there is no account to create. No analytics, no tag manager, no advertising, no embedded video, no social widget, no font service, no error reporting.
Every asset, including the typefaces, is served from this domain, so opening a page here does not cause your browser to contact another company. The one exception is deliberate: the contact form posts to our own handler, and only when you press send.
What the server sends back
| Header | Value |
|---|---|
Content-Security-Policy | default-src 'self', img-src 'self' data:, style-src 'self', script-src 'self', font-src 'self', frame-ancestors 'none', base-uri 'self', form-action 'self' plus the form handler’s origin, object-src 'none'. No unsafe-inline anywhere. |
X-Content-Type-Options | nosniff |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | geolocation=(), microphone=(), camera=(), interest-cohort=() |
The policy forbids inline scripts and styles outright. Nothing here relies on them, so it needs none of the usual exceptions.
What this removes
What this replaced needed a server that could run code: an interpreter, a database, a login page, and a stack of plugins. Each was something to keep patched and something reachable from outside. None of them exist here.