Privacy
What this site collects, why, and how to ask about it.
This site, shapeofthesystem.com, is just a handful of static pages. No accounts, no logins, no comments, no forms. Nothing to sign up for and nothing to buy. It tries to collect as little about you as a working site can manage, and what follows explains the little that's left over, in plain terms, and tells you where to look for anything that might change later on.
Who is responsible
The site is run by Matt Williams, who decides why and how the limited data described here gets handled (the controller, to use the language of the EU GDPR and the UK GDPR). I'm based in Lithuania, so it's the EU GDPR that governs this site, and you can reach me at .
What is measured, and why
The only thing measured here is aggregate traffic. Roughly how many people read a page, which pages, which site sent them along, and the broad category of browser, device and country they came in from. I use it to know whether the writing is reaching anyone, and which pieces actually get read. That's it.
It's done with Cloudflare's privacy-first analytics, which is built so it doesn't need to know who you are:
- it sets no cookies and stores nothing on your device;
- it does not fingerprint you, build a profile of you, or follow you across other sites;
- it produces counts, not records about individuals.
How the measurement works, and what exactly each page load reports, is documented and kept up to date by Cloudflare here: Cloudflare's analytics beacon. Rather than copy those details across, since they may well change, this notice just points you at the source.
To produce the counts, your device's IP address and request details get processed briefly by Cloudflare at the moment you visit. Under the GDPR an IP address can count as personal data, which is the whole reason this notice exists, but it's only used in passing to work out the aggregate figures. It isn't stored here against you and isn't used to recognise you again later.
Legal basis. This rests on legitimate interests (Article 6(1)(f) GDPR): the modest, proportionate interest of knowing whether a freely published site is being read at all, using a method picked precisely because it doesn't track or identify its readers. Because nothing is stored on or read from your device, this site needs no cookie banner. And because the analytics can't single you out, there's nothing here for you to consent to.
Hosting
The site is served through Cloudflare. As part of delivering and protecting any website, Cloudflare necessarily handles connection data such as IP addresses, for security and so it can serve the pages to you. That processing is governed by Cloudflare's own terms, which are linked below.
Your rights
Under the EU GDPR and the UK GDPR you have rights over your personal data, including the right to ask what is held, to have it corrected or erased, and to object to its processing. I would honour any such request. I should be straight with you about one thing, though: the analytics described here keep no identifier for you, so in the ordinary case there's no stored record I could look up, single out, or delete on request (Article 11 GDPR).
If you think data about you has been mishandled, write to me at . You also have the right to complain to a data protection authority. Since I'm based in Lithuania, the lead authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). If you're elsewhere in the EEA or in the UK, you can instead approach your own national authority (in the UK, the Information Commissioner's Office, ico.org.uk).
Changes
If this notice changes, the date below changes with it. Material changes are reflected here rather than announced, because there's no mailing list to announce them to.
Last updated 21 March 2026.