Thank you! You are too kind.
FYI this is now deployed and live, the privacy point was huge and I wanted to make it clear that this is CSR only, and the # was perfect. Now if you route to a legacy path i.e. without a #, you will be redirected to the memlink protected behind the #.
I will still work on a privacy policy that outlines these things :) Thank you again for the great feedback.