What I collect, and what I don't.

OnSystem is run by one person. This page is written the way I'd explain it to you in a message, not the way a legal template would.

The short version

What analytics actually records

When analytics is running, Google Analytics collects the ordinary things:

• Which pages you view, in what order, and how long you stay
• Where you arrived from — a search engine, a link on another site, or directly
• Approximate location, derived from your IP address at roughly the city level. Google does not give me your IP address itself, and the tag is configured to have it anonymised
• Device and browser — screen size, operating system, browser name
• A few specific actions: clicking through to a live demo, clicking a buy button, and how far down a page you scroll
• A random identifier stored in a cookie, so a second page view is recognised as the same visit rather than a new stranger

What it doesn't record

• Your name or email, unless you email me yourself
• Anything typed into a form — there are no forms on this site
• Advertising or cross-site tracking data. Google's ad-related consent signals are switched off permanently on this site, in every country, whether or not you accept analytics. That isn't a setting waiting to be flipped; it's how the tag ships
• Anything that gets sold, rented, or handed to advertisers

Whether you're asked first

This depends on where you are, because the law does.

• In the EEA, the UK and Switzerland, nothing is stored and no analytics runs until you choose. You'll see a banner with Accept and Decline. Decline and the site behaves identically — nothing is withheld, nothing nags you again.
• Everywhere else, analytics is on by default and there's no banner. That's the standard practice those jurisdictions allow. If you'd rather it weren't, the opt-out below works from anywhere.

Advertising signals stay off in both cases. The only thing that varies by country is whether I ask before counting a page view.

Buying a kit

Payment is handled entirely by Lemon Squeezy, who act as the merchant of record. They collect your email and payment details on their own checkout pages, under their own privacy policy. I never see your card details — they don't pass through this site or any server I control.

When you click a buy button, the link carries the anonymous analytics identifier described above into the checkout, so that if a purchase completes I can tell which page led to it. It carries no name, no email, and nothing that identifies you — just the same random number already in your browser. If analytics is off for you, nothing is attached at all.

What's stored in your browser

Name	What it's for	How long
onsystem-consent	Remembers your Accept or Decline so you're not asked again. Set on .onsystem.design so the demo subdomain doesn't ask a second time.	180 days
onsystem-theme-*	Remembers light or dark mode per page. Stored locally, never sent anywhere.	Until cleared
onsystem-geo	Caches your country code for the current tab, so the page doesn't re-check it on every view.	The browser tab
_ga, _ga_*	Google Analytics. Only set once analytics is permitted.	Up to 2 years

The first three exist to make the site work and to honour your choice; they're not tracking you. Only the Google Analytics ones involve a third party.

Changing your mind

• If you accepted and want to undo it: clear this site's cookies in your browser settings. You'll be treated as a new visitor and asked again if you're in a region where I ask.
• From anywhere, permanently: install Google's Analytics opt-out browser add-on, or use any content blocker. The site works normally either way — I've tested that it does.
• If you're in the EEA, UK or Switzerland, you have rights of access, correction, erasure, restriction, objection and portability over personal data relating to you. Analytics data here is pseudonymous and not linked to your identity, which limits what I can practically find, but email me and I'll do what can be done.

Who else sees anything

• Google — analytics, as described above. Data is processed on Google's infrastructure, which includes servers outside Europe.
• Cloudflare — serves this site, so it necessarily handles the request itself. It also tells the page which country you're in, so the site knows whether to ask you about analytics. That check is a request to the same domain you're already on; your IP goes nowhere new.
• Lemon Squeezy — only if you buy something, and only on their own pages.

Nobody else. There are no advertising networks, no session recorders, no heatmaps, no chat widgets, no embedded social scripts.

How long it's kept

In Google Analytics, the detailed event data is deleted after 2 months and the browser-level data after 14 months. The 14-month clock restarts each time the same browser visits again, so it measures time since you were last here rather than since you first arrived. After those windows, only aggregate figures remain — visits per page, that sort of thing — and those no longer relate to any individual browser.

Order records are held by Lemon Squeezy as the merchant of record, for as long as their own policy and the relevant tax rules require.

Getting in touch

Questions, corrections, or a request about your data: [email protected]. It reaches me directly, and I'll answer.

Last updated 29 July 2026. If this changes in a way that matters, the banner will ask you again rather than quietly assume your old answer still applies.