That's not the whole truth. While you may be deleting the submitted form values, your site uses a third-party tracking service which collects a range of visitor data[0] which is stored by that third party. Third-party tracking is useful and mainstream, but you should have a privacy policy and disclose the tracking in that policy.
On a more positive note, your site has a solid A+ for HTTPS configuration on SSL Labs[1], so that's great to see. The only change I would make is to switch server_tokens to 'off'[2] so you aren't leaking the Nginx version number (but this is admittedly just a minor bit of security through obscurity).
[1]https://www.ssllabs.com/ssltest/analyze.html?d=whoaremyrepre...
[2]http://nginx.org/en/docs/http/ngx_http_core_module.html#serv...