Say hello.
Hiring, a question about something I've built, or just want to tell me the pixel canvas is broken — this reaches my inbox. No third-party form service, no CAPTCHA, no tracking: it posts to my own domain and sends through my own mail infrastructure.
Every off-the-shelf CAPTCHA is a third-party script, which means a new origin in the content-security policy. The spam defence here is a honeypot, a timing check and a per-sender rate limit — all server-side, none of it visible to you.
Messages are sent from a domain with SPF, DKIM and DMARC configured, with the envelope sender aligned so both mechanisms pass rather than just one. Read how that's built.
Your message goes to my inbox. For rate limiting, a one-way hash of your IP address is kept for an hour and then deleted automatically — the address itself is never written down.