Molehill Creations
Privacy
The short version: this site is a shop window. It has no accounts and no logins, it doesn't sell or share anything about you, and the only personal details it ever receives are the ones you type into the contact form.
Who's asking
Molehill Creations is Tom Peck, a product workshop in Wellington, New Zealand. Anything on this page, you can take up with me directly at tom@molehill.co.nz.
The contact form
If you send me a message, I get your name, email address, the package you picked and what you wrote. It's emailed to me and answered by me. Nothing goes to a CRM, a mailing list or an ad platform. The email is delivered by Resend, who handle it as a mail provider and nothing more. I keep the correspondence for as long as it's useful to the conversation; ask and I'll delete it.
You also get a copy back: a confirmation to the address you gave, so you can see the form worked and what it sent. That's the only email you'll ever get from me that you didn't ask a question to receive.
The form gets a fair amount of bot traffic, so submissions are scored for spam before they reach me. Nothing is thrown away: one that scores badly is written to a file on the server for a fortnight instead of being emailed, so that if a real message is ever caught by mistake it can still be found. No CAPTCHA, and nothing about you is sent to a third party to make that judgement.
Analytics
I count page views so I can see which pages people actually read. It runs on Umami, self-hosted on a server I run, so the numbers never leave infrastructure I control and no analytics company gets a copy. There are no advertising cookies, no cross-site tracking, and no profile of you anywhere in it.
What it records for each visit: the page, the site that sent you, your browser, operating system, device type, screen size, language and country. Your IP address is used to work out the country and to group a visit into one session, then discarded. It is never stored. There's no identifier that survives the day, so I can't tell a returning visitor from a new one, which is the trade I'm making. Blocking it with a content blocker breaks nothing on this site.
It also notes which parts of a page you scroll far enough to read, which links and buttons you click, and whether you started typing in the contact form. That is how I tell a section people read from one everybody scrolls past, and whether the form is where enquiries go to die. What gets recorded is that a thing was reached or clicked. Never what you typed into it.
One thing is counted from my side rather than from your browser: when a contact message goes through, it records that one was sent and which package was picked. That's so I can tell whether the form is working at all. Your name, email address and what you wrote are not part of it and never reach the analytics. They go only to my inbox.
Session recording
I'll be straight with you, because this one goes further than counting. Visits to this site are recorded: what the page looked like, where you moved and clicked, and how far you scrolled, played back later like a screen recording. It's the same Umami on the same server I run, so no session recording company is involved and nobody else gets a copy. I use it to see where the site confuses people, and to build the click and scroll heatmaps that tell me which parts of a page anyone actually reaches.
What you type into the contact form is masked before it leaves your browser. The recording knows a field was filled in; it does not know what you put in it. Nothing you type is captured, on this or any other field. Recordings also store no images. A picture on the page is noted by its address and fetched again at playback, so no picture is ever copied into one.
A recording covers one visit, caps out after five minutes, and is not tied to a name or an account, because this site has neither. It's the same session as the page counting above, so the same IP-address-then-discarded applies. A content blocker that stops the analytics stops the recording with it, and breaks nothing on this site. If you'd rather I didn't, or you want a visit deleted, email me and it's done.
The mini-game
The little climbing game on the SkyGames page records how each round went (a random session id, your score, how high you got and how long it took) so I can tell whether the thing is any fun. It also stores your browser's user agent and a one-way hash of your IP address, used only to keep one enthusiast from looking like a thousand players. The raw IP is never written down, and none of it is linked to you.
What I don't do
No accounts. No advertising or cross-site tracking. No selling, renting or sharing your details with anyone. No sneaking your contact-form message into a mailing list you didn't ask for.
The apps have their own policies
This page covers molehill.co.nz only. Each product in the workshop runs on its own site, collects its own data and publishes its own policy. If you actually use one of them, that's the page you want:
Your data, your call
Under the NZ Privacy Act 2020 you can ask what I hold about you, ask for a copy, or ask me to correct or delete it. Email tom@molehill.co.nz and I'll sort it. There's not much of it, so it won't take long. If I ever change this page materially, the date below changes with it.
Last updated 25 August 2026