Privacy · cookies · first-party measurement
MichaelHBM uses a limited, first-party measurement system to understand aggregate content use and public-crawler activity. It is designed without visitor or session identifiers and does not depend on analytics or advertising cookies.
Last updated August 7, 2026
Cookies and browser storage
As of the date above, the MichaelHBM application code does not set or read analytics, advertising, or preference cookies. Its measurement code also does not use local storage or session storage. Cloudflare, the site's delivery and security provider, sets the strictly necessary cookie described below.
__cf_bmCloudflare sets this cookie so its bot-management protection can distinguish and mitigate automated traffic. Cloudflare states that the cookie expires after 30 minutes of continuous inactivity and is generated independently for each protected site. On MichaelHBM it is currently delivered with HttpOnly, Secure, and SameSite=None attributes. It is not read by the MichaelHBM application.
There are no MichaelHBM analytics or advertising cookie preferences to configure because the site's own measurement does not rely on those cookies or browser storage. This statement covers the application behavior reviewed as of the last-updated date.
Measurement is suppressed when a browser sends Global Privacy Control or Do Not Track. Browser interaction listeners do not start when either supported signal is active. Those signals do not disable Cloudflare's necessary security cookie.
Global Privacy Control specificationInfrastructure providers and sites reached through external links may use their own cookies or similar technologies. Their policies and controls apply when those services receive a request.
What is counted
Each database row contains only the following fixed dimensions and a total. There is no underlying event-level log in the application database.
A UTC calendar day and a count. The system increments an aggregate row instead of creating a request, visitor, or session record.
Known public-crawler labels such as Googlebot, Bingbot, OAI-SearchBot, or a single human/unknown category. The raw user-agent string is discarded.
Page and discovery views; navigation and project selections; tracker filter changes; episode and audio progress; transcript and resource downloads; outbound links; and contact intent. Only the event category and canonical path are sent—filter values and search terms are not.
A path without a query string, plus a content type and short content label derived from that path by the server.
Categories such as direct, internal, Google, Bing, ChatGPT, Perplexity, LinkedIn, YouTube, podcast platform, or other. The full referrer is discarded.
What is not collected
The first-party measurement code does not collect or store IP addresses, raw user-agent strings, full referrers, query strings, search terms, form or message contents, email addresses, visitor IDs, session IDs, fingerprints, or precise location.
The application targets a 730-day window. On each new measurement write, it removes aggregate rows older than that window.
Aggregate reports require a server-held access token. The reporting endpoint is unavailable when the token or database connection is absent.
Because the application stores counts across fixed categories, it does not provide a visitor-level record that can be accessed, corrected, exported, or deleted.
Other services
External services are not part of MichaelHBM's aggregate measurement database. Their own privacy notices, cookie choices, retention practices, and account settings apply.
Hosting and infrastructure providers necessarily receive ordinary network request information to deliver and protect the site. Their processing is governed by their own terms and policies.
The AI Change Desk player is hosted on RSS.com infrastructure. Episode pages are designed not to preload the audio; activating playback sends the request to RSS.com, which operates under its own privacy policy and technical controls.
RSS.com privacy policyLinks may open YouTube, Spotify, Apple Podcasts, RSS.com, LinkedIn, Amazon, Audible, iHeart, LegiScan, government sites, publishers, or other sources. Once opened, those services control their own collection and cookies.
Contact links open the visitor's email application. Messages and addresses are then handled by the visitor's and recipient's email providers, not by an on-site contact form.