What if analytics collected nothing about people?

When I started sending my CV out, I had a small, honest question: does anyone actually open my portfolio site?

It is a modest question, but I decided to treat it seriously — because how someone answers a small measurement question tells you a lot about how they will answer big ones.

The easy answer, and why I paused

The easy answer is Google Analytics. It is free, it works, and for many teams it is a perfectly reasonable choice. I don't think less of anyone who uses it.

But it sat badly with me for this site. My portfolio's operating principle is "evidence before adjectives" — and the first piece of evidence I collected would have been my visitors' data, handed to a third party, with cookies, for a question as simple as did anyone come? That felt like using a warehouse to store a letter.

So I built the measurement myself, on the small server setup I already run at home. It took about a day.

What I built, in plain terms

If you are not technical, here is the whole system in one picture:

A front door counter. When someone opens a page, the site quietly raises its hand once: "one visit, this page, from this country." That is all it says.
A locked filing room. Those counts go into a private database that nothing on the internet can reach.
A private reading room. The charts — visits per day, which pages, where from — are visible only inside my home network. There is exactly one person in the world who needs to read them, so there is exactly one who can.

The rule underneath is simple: collecting is public, because visitors are; reading is private, because only I need it. Most data problems I have seen in my career come from blurring that line.

What a visitor gives up: almost nothing

The system keeps five small facts per visit: which site, which page, which website referred them, which country, and a scrambled one-day code. That code lets me see that two visits this afternoon came from the same person — but the code changes every midnight, so by tomorrow even I cannot connect them. No names, no accounts, no cookies, no addresses stored. If a regulator, a recruiter, or my own mother asked me to explain what I keep about visitors, the full answer fits in this paragraph.

I have spent years in quality assurance, and one belief has survived all of them: a rule that matters must live inside the system, not inside a document. So the privacy rules here are enforced by the database itself — it physically refuses records that break them. Nobody has to remember to behave.

What went wrong, and what I keep relearning

The build was not smooth, and pretending otherwise would defeat the purpose of this site. Three moments stayed with me.

The page that was fine on my screen and broken on everyone else's. A caching mistake meant I was seeing the new version of my site while every other visitor saw a broken one — for hours, invisibly. The lesson is old and humbling: "it works for me" is the least trustworthy sentence in technology. The fix was not cleverness; it was checking from outside my own window.

Safety settings that fought each other. I locked the system down so tightly that one component could not even start — its own setup routine needed permissions I had removed. Security that nobody can operate is not security; it is theatre. The mature version keeps the protection and redesigns the path, rather than quietly switching the protection off.

Small systems fail exactly like big ones. Every failure I met in this one-day project — stale caches, permissions, order-of-operations — I have also met in enterprise programmes with hundred-person teams. Scale changes the blast radius, not the physics. Which is why good habits are worth practising at small scale, where the tuition is cheap.

Why this belongs on a portfolio

I lead quality and delivery for a living, and I am moving my career toward applied AI leadership. The connection is direct: an AI system, like an analytics system, earns trust the same way — define what "working" means before you build, collect just enough evidence to know, put the hard rules in the system rather than in promises, and keep the sensitive surface as small as possible.

Just as important: being able to explain such a system to someone who will never read a line of code. If I cannot describe my own analytics to a CRM user, an HR director, or a compliance officer in plain language, then I do not understand it well enough — and no amount of technical depth compensates for that.

An honest boundary

This is a personal-scale system: one website, one home server, visitor numbers in the dozens. I am not claiming enterprise scale. I am claiming that the shape is right — and the shape is the part that carries over.

Built, and written, alongside an AI pair-engineer; every claim above was checked against the running system before publishing.