Privacy
Cairn uses PostHog to count page views, page-leave (with how long you stayed and how far you scrolled) and three kinds of link click, and no other events. No campaign parameters or search words are sent, page addresses are cut at ? and #, and there is no session recording, no autocapture and no advertising cookies. Business facts do not depend on that script: they ship in the initial HTML, readable with JavaScript disabled. The only information this site collects itself is what you choose to type into the "Report an error" form, and the ordinary web-server request logs kept by Firebase Hosting. Nothing is sold, and nothing is shared beyond what this page describes.
Cookies and analytics
This build loads a PostHog snippet so the publisher can see which pages are read and which links are followed. PostHog may set its own first-party cookie or browser-storage entry to tell one visit from the next; it sets no advertising cookies. That cookie (kept up to a year) and a matching browser-storage entry on your device hold a random identifier, and can also keep the address of the page you arrived on and the page you came from, including anything after a ? or #. That copy stays on your device and is never sent to PostHog. Autocapture and session recording are off. No business fact is assembled or revealed by that script — a GPTBot fetch with JavaScript stripped still contains every required fact. The project key is supplied at build time as PUBLIC_POSTHOG_KEY; this repository does not ship a real key.
What the analytics records
This build records exactly the five events listed here: page views, page-leave and three kinds of link click. Every other kind of event PostHog could send is dropped in your browser before anything leaves it.
$pageview: You open a page. PostHog records the page address (cut as described below) and the page title. Plus PostHog's standard details, below.$pageleave: You leave a page (page-leave), with how long you stayed and how far you scrolled. Plus PostHog's standard details, below.outbound_click: You follow a link on an operator's record page to that operator's own website, phone number or email address. Properties:operator(the record's short web name, for example arizona-safari-jeep-tours);kind(website, phone, email or booking).promo_click: You follow the link in a "From the publisher of this index" card. Properties:promo(which of the publisher's own ventures the card is for);page(the path of the page you were on, with no query string).readback_click: You follow the "Book a free read-back call" link on a business's record page. Properties:operator(the record's short web name).
When you leave a page, the analytics also records how long you stayed on it and how far you scrolled. This site adds no text you typed, no form entry, no query string and no personal information to any of these events, and the link's address or phone number is never sent. No campaign parameters are sent: the utm_ tags and ad-click identifiers such as gclid or fbclid that can ride on a link into this site, and the search words a search engine passes along, are removed in your browser before anything is sent. Page addresses, including the address of the page you came from, are sent without any query string or fragment: whatever follows a ? or a # is cut off in your browser before anything is sent. There is no autocapture, no session recording, no heatmaps, no error or performance reporting, no surveys and no advertising cookies.
PostHog's own library adds its standard details to each of these events: a random identifier it keeps in your browser to tell one visit from the next, the time, your browser's language and time zone, its full browser (user-agent) string and the browser, operating system and device type read from it, your screen and window size, and the domain of the page you came from, with the search engine's name if that was a search engine (not your search words). It also adds its own bookkeeping, such as the library's version and session and event identifiers. As with any web request, PostHog also receives your IP address, which it may use to estimate a country or city.
What the report form collects
The "Report an error" link opens your own email application with the page, which fact is wrong, and what it should say already filled in, addressed to Thomas Karl. It does not submit to a server this site operates at all — nothing leaves your device unless you send that email yourself, and whatever you write beyond the pre-filled prompts is between you and Thomas Karl.
Hosting request logs
This site is served by Firebase Hosting, a Google Cloud product. Like any web host, it keeps ordinary request logs — the requested path, timestamp, and technical details such as the requesting IP address and user agent — for operating and securing the service. Those logs are held by Google, acting as a data processor on Sedona Tech Solutions LLC's behalf, under Google's own Cloud terms; Cairn runs no analytics dashboard on top of them.
No third-party requests
Every asset a page needs to read its facts — the stylesheet, the brand art, and the Besley, Archivo and JetBrains Mono fonts the brand book calls for — is self-hosted from sedonaindex.com. Nothing is fetched from Google Fonts, a CDN, or an ad network. When analytics is on, the browser also requests PostHog’s own script and ingest hosts; that traffic is analytics only and is not a source of business facts.
No sale of data
Nothing collected here is sold, rented, or shared with a data broker, an advertiser, or any other third party. The only sharing that happens is answering a correction you sent us.
Reporting a security issue
This site publishes a security.txt file (RFC 9116) naming who to contact about a vulnerability. Use it, or email thomas@sedonatechsolutions.com directly.
Contact
Questions about this policy: Thomas Karl, Sedona Tech Solutions LLC — thomas@sedonatechsolutions.com. By post: PO Box 3025, Sedona, AZ 86340.