Check it yourself
I state that this website sets no cookies, loads nothing from third parties and that the contact form stores nothing. You do not have to take my word for it: below, for each claim, is what you should see on www.vdhome.be.
The steps to check it in your own browser are on What does a visitor of your website see?.
Checked on 16 October 2026.
2. No requests to third parties
What you should see on www.vdhome.be: With the filter -domain:www.vdhome.be an empty list, or in Safari only www.vdhome.be. The fonts come from www.vdhome.be itself too. One exception, and it is mine: on the contact page your browser fetches an anti-spam puzzle from forms.vdhome.be when you start typing, and your request goes there when you send it.
3. The Content-Security-Policy
The Content-Security-Policy is the rule that tells your browser where a page may load anything from. Whatever is not in it, your browser refuses by itself.
In the page source
- View the page source: Ctrl+U in Chrome, Edge and Firefox (Cmd+Option+U on a Mac); in Safari: Develop > Show Page Source.
- Look near the top for
<meta http-equiv="Content-Security-Policy". Among others it readsdefault-src 'self'andconnect-src 'self' https://forms.vdhome.be: only this website itself, plus my form.
In the response headers
On the page itself (the first request in the Network tab): Content-Security-Policy with frame-ancestors 'none', and X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Strict-Transport-Security.
The scripts on the page are listed by their hash (sha256-...): a script that is not in it exactly like that, your browser does not run.
What the contact form sends, and where
The form sends your request over an encrypted connection to forms.vdhome.be: my own server at Hetzner Online GmbH in Germany. That server places the request as a message directly into my own mailbox (info@vdhome.be, Google Workspace), using the Gmail function that inserts a message: it cannot send e-mail itself, to anyone.
The server itself stores nothing: no content and no IP address in its own logs.
You can see the request yourself: open the Network tab before you send and click the request to forms.vdhome.be/v1/request. Under Payload or Request you see exactly what leaves.
What leaves: the chosen service, the language, the size of your organisation, your name, e-mail address, organisation, role, sector, deadline and your question, an empty hidden field against spam robots and the solution of the puzzle.
The source code is public under the EUPL-1.2 licence: you can read what the server does with your request.
Which providers I use
The same list as in the privacy notice. There are no others: no analytics, no advertising networks, no external fonts or scripts.
Google (Firebase Hosting)
- For what
- Serves this website (www.vdhome.be)
- Where
- Google's worldwide network
- What they can see
- Server logs of every visit, for the operation and security of the service
Hetzner Online GmbH
- For what
- Server of the contact form (forms.vdhome.be)
- Where
- Germany
- What they can see
- Your request while it is passed on; it is not stored there
Google Cloud EMEA Ltd (Google Workspace)
- For what
- My mailbox (info@vdhome.be)
- Where
- Ireland; Google may process data outside the EU
- What they can see
- Your request and my correspondence
Which version you see
At the bottom of every page is a version stamp: the short code of the change (git commit) the website was built from, and the date of that build. Both are written into the page when it is built; the page fetches nothing for them.
What it means: if you report an error or a statement on the site, that code lets me find exactly which text you saw. What it is not: proof you can recompute yourself. The source code of this website is not public; that of the form server is (see above).
This page: version d4cf0a3a, built on 2026-10-22
Reporting a security problem
Found a vulnerability? The security.txt file of www.vdhome.be says how to report it.