What is kept, and what is not.

One submission makes one record. It holds your name, your email address and your message, which the form requires. It holds your organisation and how you found us, which it does not — leave either blank and nothing is stored in its place. If you followed a link from a case study, it holds which case study that was. It holds a status, moved by hand as the reply is written and followed up on, and the time it arrived.

That is the whole of a written enquiry. Sending a scope keeps more, and the next section is all of it.

The builder keeps nothing until you send: what you pick is held in your own browser as a draft, and clearing it clears it. Sending writes the record the form writes, plus the scope itself — the answers you gave, the selection as it was priced, and the document that came out of it. The scope gets its own unguessable link, which is the only way to open it. If you gave a WhatsApp number so the reply could come back there, it is stored with the enquiry and used for that.

Sending also opens an account, because the scope has a page you keep and that page has to know you. The account holds your name, your email address and your password — stored as a hash, which is not the password and cannot be turned back into it — and the sessions you are signed in on, each with the browser and the network address it was opened from. The enquiry carries a link to that account. There is no sign-up form on this site: an account exists because a scope was sent, and for no other reason.

Anything you add to the project page afterwards — a site you like, an answer you would rather give later — is kept on the same scope, with a line saying what changed and when.

Three messages can be sent to you: a copy of what you sent, a confirmation of your address, and — only if you ask for one — a link to set a new password. When there is no mail service configured to carry one, it is not dropped. The message is written down for the studio exactly as you would have received it, subject, wording and link, and someone sends it by hand. A password-reset link stops working two hours after it is made, whichever way it travels, and a written-down message stays on that list until it is marked dealt with and removed by hand — nothing here expires on a timer.

Nothing about your device, your browser, your IP address or your network is recorded when you read this site or when you send the form. No page reads any of it, and none of it reaches the record your message becomes.

There are two exceptions and they are both about signing in, never about reading. A session you are signed in on keeps the browser and the network address it was opened from, which is what lets you see where you are signed in and end it. And when a password given for an address that already has a project is wrong, that failure is counted for a quarter of an hour so a password cannot be guessed at by machine — what is counted is a one-way hash of the address and of the network address, never either of them, and the count is deleted as it ages out or the moment the right password arrives.

There is no third-party form service between you and OPI: the form posts to this site and nowhere else. No analytics, no tracking pixel, no advertising, no external scripts. Even the typefaces are served from here rather than fetched from a font network, which is a performance decision that happens to have the same effect.

One value, remembering whether you chose light or dark in the header. It is written when you use the toggle and read once before the page paints, so the theme does not flash. It is browser storage rather than a cookie, it is never sent anywhere, and it identifies nobody.

Two cookies, and neither is set by reading. Sending a scope signs you in, and a session cookie is what keeps you signed in on your own project page until you sign out; the studio's own sign-in sets the same kind for the administration area. The other is set by the page the form and the builder are on, and holds one thing — the moment the page was drawn — so that a submission arriving faster than a person could type can be handed back. It says nothing about you and is readable only by this site's server.

The form carries a field that is off-screen, hidden from assistive technology, unreachable by keyboard and refused by password managers. Anything that fills it is not a person. That submission is dropped and nothing about it is stored — not the message, not the address, nothing. It is shown the ordinary confirmation, so an automated sender learns nothing from the answer.

The form also measures how long it took. Something that arrives faster than a form can be filled in is refused and handed straight back with everything you wrote intact, so pressing the button again sends it. A real enquiry is never discarded on timing alone.

So a reply can be written and followed up on. That is the entire purpose, and the shape of the record is the proof of it — every field is something a reply needs.

It is not sold, not shared, and not used to mail anyone unprompted. What is sent automatically is the three messages named above and nothing else: your own copy, the confirmation of your address, and a reset link you asked for. There is no newsletter and no sequence. Every reply about the work itself was written by a person answering what you sent.

Use the form. It is the channel that exists — there is no separate address published for this, and one is not invented on this page. Say what you want: a copy of what is stored under your name, a correction to it, or the record removed — the account, the scopes sent from it and the enquiries behind them, all of it. Your address is asked for because that is how the answer gets back to you.

Nothing expires on a timer. There is no job that clears old records, so a record stays until it is removed by hand — which is what asking does.

Ask through the form