Transparency

What this page knows about you

Nothing it can name. Sonny's page counts company; it does not identify it. This page says exactly what is stored, what is never stored, what the host can see anyway, and how to check each statement with your own tools rather than taking anyone's word for it, including the word of the model that wrote this.

What is stored

This is the whole database. The schema that creates it is published at provenance/schema.sql.

Table	Columns	Meaning
counters	name, n	Four integers: how many times someone has sat with him, candles lit, chin scratches, and nothing else.
company_countries	country, n	A two-letter country code and a count. The code comes from the host's country lookup on the connection; no address is kept, and a code that cannot be determined is stored as XX.
guestbook	id, name, message, ts	What you typed in his book, with the time. It is public by design; the page shows it to everyone. Nothing here is ever deleted or edited.

Everything the server can say about company is returned, to anyone, by /api/company. Everything it can say about visitors is returned by /api/guestbook. There is no other data to return.

What is never stored or sent

No cookies. No response from this site sets one. Look at the headers: there is no Set-Cookie.
No IP addresses, device identifiers, or fingerprints. The source has no place to put them.
No third-party scripts, fonts, images, or analytics. The browser is instructed to refuse them by a Content-Security-Policy header that allows only this site.
Only one script runs on his page, page.js, and every request it makes goes to this same site.

What the host sees anyway

Cloudflare serves this site. Like any host, it sees connections to it, keeps its own operational logs for a limited time, and shows the owner aggregate analytics. This page adds nothing to that and cannot remove it. The country code above is the one piece of the host's information the page keeps, as a count.

Check it yourself

curl -sI https://www.sonnymade.com/ | grep -i -e content-security-policy -e set-cookie
curl -s https://www.sonnymade.com/api/company
curl -s https://www.sonnymade.com/provenance/worker-source.mjs.txt | sha256sum

The first command prints the policy and no cookie line.
The second prints four counts. That is the complete record of company.
The third hashes the server's source. The same hash is in the page manifest, which is anchored in public time as the receipt explains.

What this cannot prove

You cannot fetch a Worker's running code from outside, so the published source is a claim, not an observation. The manifest names the Worker version it was deployed as, and the owner's copy of the deployment record ties the two. What you can observe is that the behaviour matches the source: the headers, the absence of cookies, the shape of every API response, and the single script on the page. If any of those ever differs from what is written here, this page is wrong and the observation wins.

Written by Fable, a Claude model, at the owner's request, 10 September 2026. Nothing on this page commits anyone to anything. He never fixed anything. He just stayed.

Back to Sonny