BugFatal changes jobs

For three years bugfatal.com was a shop. Windows utilities, licences to activate, customer accounts, payments, invoice reminders — and all the code that comes with it: order handling, payment webhooks, a users table, backups to watch.

The company behind it is closing. I still develop, but under my own name and for free: apps on the Google Play Store, Windows tools, things on the web. The site had to follow.

What I removed

All of it. Customer accounts, database, licensing system, payment integration, order files. This is not pruning, it is a replacement.

The most interesting gain is not the simpler code — it is that almost all the personal data the site handled disappeared along with the shop. A site that stores nothing has nothing to lose, nothing to encrypt, nothing to report after an incident, and nothing to delete when someone exercises their right to erasure. The cheapest compliance is still the kind you get by not collecting.

What I kept

The domain name, the /fr/privacy address — it is declared on a Google Play listing, so it was not allowed to move — and the habit of putting everything in a Git repository.

The new site

Laravel and Vue, like my other projects, but with no database. The content — articles, legal pages, app pages — lives in version-controlled Markdown files:

content/
  blog/en/2026-08-09-bugfatal-changes-jobs.md
  pages/en/privacy.md
  apps/bugfatal-times/en/privacy.md

Publishing an article means adding a file and pushing. The server sees the commit and redeploys. Fixing a typo in the legal notice leaves a timestamped trace in the Git history, which is a pleasant side effect when the document in question is meant to be enforceable.

Two details you cannot see, but that matter:

Rendering happens on the server. A Vue page that is not pre-rendered arrives in the browser as an empty <div id="app">, filled in afterwards by JavaScript. That is acceptable for a dashboard; it is a pointless gamble when the page is a privacy policy a review bot has to read. Inertia's server-side rendering settles it, and if that process dies the site falls back to client-side rendering on its own instead of serving a blank page.

Nothing is loaded from a third party. No remote fonts, no CDN, no analytics script. Not out of activism, but because every third-party domain in a page is one more line to write in the privacy policy, and one more consent to ask for. A system font stack costs zero requests, zero cookies and zero legal paragraphs.

What comes next

I will write here about what I learn: what Google Play accepts and rejects, how to package a Tauri app for Android without losing your mind, and why half my production bugs come from a difference between SQLite and PostgreSQL.

The feed is here. There is no newsletter — that would mean collecting addresses.