Comment by ghais_dev

And enough control to keep a privacy promise. My evening project is a free, no-signup web app on Pages. A _headers file gives me a strict CSP, so I can say "exactly two remote origins" on the privacy page and anyone can verify it in devtools. Redirects, a custom domain, static files plus one API origin, zero cost for over a year. The product has no business model, so without that free tier it simply would not exist.