Privacy Policy

Last updated: October 11, 2026

This website (masonobegi.com) is run by Obegi Software LLC, a Washington limited liability company and Mason Obegi's web studio; "I" below means Obegi Software LLC. It is both a portfolio and the site for my web-design work, and this policy covers both. It is written plainly rather than in legal language, and it describes what the site actually does. The section further down on hosting, billing and text messages covers the clients whose sites I host.

What I collect

Things you type. There are five places on this site to send me something: the contact form, the questionnaires on my ad landing pages, the "email me this report" form on the Website Checkup, the review form, and the comment box under Library articles. Each one sends me what you enter — usually your name, email address and message, plus a phone number if you choose to give one. Nothing on this site asks for payment details.

Reviews. The review form also takes your business name, your website and a star rating if you give them, and an optional logo or photo, which is uploaded to the site's storage as soon as you choose it. Your IP address is saved with the review so I can tell a real client from an impostor. Nothing is published until I have checked it. Once it is, the quote, your name, business, rating, website and logo appear on the site; your email address never does.

Comments. A comment under a Library article is published straight away, under the name you give or under none. The email field is optional and is used only to email you when someone replies; it is never shown on the page.

The Website Checkup. When you check a site, my server fetches that address and grades what it finds. The report is held in the server's memory for about ten minutes and then forgotten. It is saved only if you ask me to email it to you, and then it is attached to your enquiry.

Where you arrived from. If you reach the site from an ad or a campaign link, the campaign tags in that link (utm_source, utm_medium, utm_campaign, utm_term, utm_content, and the click identifiers gclid, fbclid, li_fat_id and msclkid), the page you landed on and the site that sent you are kept in your browser's session storage while the tab is open, and attached to anything you submit. That is so I can tell which campaign produced an enquiry. It is discarded when you close the tab.

Analytics. This site uses Google Analytics 4. It sets cookies and records things like which pages you visited, roughly where in the world you are, and what kind of device you used. IP anonymisation is switched on, so your full IP address is not stored by Google. I use this to see which pages are worth keeping and which are not.

Google Ads. When I advertise on Google, this site loads Google's ads tag. If you arrive by clicking one of my ads, it records that click and whether you then sent an enquiry, so I can tell which ads bring in work. It sets its own cookies to do that. Ad personalisation is switched off: I do not build remarketing lists, and this site is not used to follow you around the web with ads.

Fonts and videos. The site's typefaces come from Google Fonts, so your browser fetches them from Google's servers, which see your IP address as they would for any request. Some project pages have a YouTube trailer: its still image loads from YouTube's image server, and the player itself (from youtube-nocookie.com) loads only when you press play, after which YouTube's own privacy policy applies.

Server logs and limits. The site is hosted on Railway and served through Cloudflare. Both keep standard technical logs — IP address, browser type, time of request — for security and reliability. The site itself holds your IP address in memory for about ten minutes to limit how many forms one address can send. That is ordinary infrastructure, not something I set up to watch visitors.

What I do with it

I use what you send me to reply to you and, if we end up working together, to do the work. I use the analytics to improve the site. I do not sell, rent, or trade your information, and I do not use it for advertising to you.

Who else sees it

Only the services that make the site run:

• Railway — hosting, the database that stores form submissions, and uploaded files
• Cloudflare — serving the site, and forwarding email sent to [email protected]
• Resend — sending the site's emails: the notification I get when you submit a form, and the one telling you someone replied to your comment
• Google — Analytics, the Ads tag, and the fonts
• YouTube — a trailer's still image, and the player if you press play

Booking a call happens on Cal.com, under Cal.com's own privacy policy. Billing and text messages for hosting clients also involve Stripe and Twilio, as set out below. Each service sees only what it needs to do its job. I do not share your details with anyone else unless the law requires it.

Cookies and browser storage

The site sets no cookies of its own for visitors. Its only cookie is the sign-in cookie for my own admin dashboard, which nobody else receives. It keeps one item in your browser's session storage — where you arrived from, described above — which is gone when you close the tab. Google Analytics and the Google Ads tag set their own cookies, as described above. If you would rather not be measured at all, your browser's tracking protection or an ad blocker will stop them, and the site works exactly the same without them.

How long I keep it

Form submissions are saved in the site's database and emailed to me. Nothing deletes them automatically: an enquiry that turns into a project is kept with that project's records, and the rest I delete by hand once they are no longer useful — or straight away if you ask. A backup downloaded from the site's dashboard includes them, and I keep any such copy privately. Published reviews and comments stay up until they are removed, by me or at your request. Analytics data expires on Google's own schedule.

Your choices

Email me and I will tell you what I hold about you, correct it, or delete it — a review or comment you posted included. I do not require a formal request or a reason, and there is no charge. If you are in a place with a legal right to any of that — the GDPR in Europe, or the CCPA in California — this is how you exercise it.

Client data

If I build or maintain a site for you, I may have access to your customers' information. That data is yours, not mine. I do not use it for anything other than the work you have asked for, I do not copy it elsewhere, and it leaves with you when the work ends.

Children

This site is not directed at children under 13, and I do not knowingly collect anything from them. If you believe a child has sent me something, email me and I will delete it.

Links out

This site links to other places — GitHub, LinkedIn, Chess.com, YouTube, Cal.com, and the live sites I have built. What they do with your information is governed by their own policies.

Changes

If this policy changes, the date at the top changes with it.

Contact

Questions, or want your information removed? Email [email protected] or call (360) 921-0148.

Privacy Policy — Billing, Email & SMS

This section describes how Mason Obegi (“I”, masonobegi.com) handles data for website hosting and billing.

Information I collect

For hosting clients I collect: your name, business name, email address, mobile phone number (if you provide one), your project's infrastructure usage metrics, and payment details, which are entered directly with my payment processor and are not stored on my servers.

How I use it

I use this information to host your website, calculate your usage-based hosting cost, send you invoices by email and (if you opt in) text message, process your payments, and provide support.

SMS / text messaging

If you provide a mobile number and consent, I use it only to send account and billing notifications — primarily your monthly invoice and its secure payment link. Message frequency is low (typically one invoice per billing cycle). Reply STOP to opt out at any time, or HELP for help. Message and data rates may apply.

I do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

Service providers

I rely on Stripe (payment processing and invoicing), Resend (email delivery), Twilio (SMS delivery), and Railway (hosting infrastructure and usage metering) to provide these services. Each processes data only to perform its function.

Contact me

(360) 921-0148 · [email protected]