The ten-second check
Open any page on this site, right now if you like. Right-click anywhere on the page and choose View Page Source, or use the keyboard: Ctrl+U on Windows and Linux, Cmd+Option+U on a Mac. A new tab opens showing the raw code behind the page. Search that page (Ctrl+F or Cmd+F) for <script, typing the angle bracket first and then the word. Nothing comes up. (Search for the bare word "script" and you will get a few false hits, because the word "description" contains it and it shows up in the page's own labels. The angle bracket is what marks a real script tag, and there are none.)
That isn't a trick for this one page. Try it on the homepage, the about page, the portfolio page, this page again, anywhere on the site. Same search, same empty result, every time, because the same thing is true everywhere here: not one script tag, not one line of JavaScript, on any page.
If you know where to look, your browser's developer tools show the same thing a different way. Open them on any page here, and there's nothing to find, because there's nothing there.
What else is checkable
There's more to check than the page itself. Every page here is served with a Content Security Policy of default-src 'none'. In plain terms: the page tells the browser to load nothing from anywhere except this site's own files, and to run no code at all.
Another line in that same policy, form-action 'none', means no form on this site could ever submit anywhere. That fits, because there are no forms. Even the typefaces are served from this site's own /fonts/ folder, not fetched from a font service somewhere else on the internet.
And the privacy policy says all of this too, in the language a policy uses instead of the language of a web page. Same claim, twice, in two different rooms of the same house.
Why no JavaScript at all
The reason isn't complicated. This site is a brochure. It tells you who we are and what we make, and a brochure doesn't need to run code to do that.
Every script on a page is something that can break, something that can quietly track a visitor, and something that can be found and abused by someone who isn't us. Leave JavaScript out entirely, and one whole category of problem simply can't happen here, because there's no code for the problem to live in. We're not claiming to have solved anything difficult. We chose the simpler thing, and it turned out to also be the safer one.
If that ever changes, the privacy policy changes first, and says so before we add anything. Right now, it says the same thing this page does: no JavaScript, none.
The one honest exception
This page is about the website: summerfieldtech.com. It isn't about WIPS, the app we build. WIPS is a real program. It runs in your browser and on Windows, and it uses JavaScript to do its work, because a program that manages your tasks actually has work to do. Its privacy promises are its own, kept on its own page: see WIPS itself and its privacy policy.
One more honest line, while we're at it: no JavaScript doesn't mean secure, and it doesn't mean perfect. It means one class of problem is off the table for this particular site. The server, the hosting, and the people running them still have to be done right, same as anywhere. Cloudflare, which hosts this site, sees requests like any host does. The privacy policy covers what that means.
So that's the whole trick: open the source, search for a tag that isn't there, and see it for yourself. If you ever do find a script hiding in here somewhere, we would genuinely like to know. Tell us at hello@