Privacy Policy
The short version: nothing about you is stored on a server. Analytics run only if you accept them — and even then, no cookies and no stored IP addresses.
Who is responsible
This is a personal blog. The address below is the data controller's contact point for everything described on this page: [email protected].
What stays on your device
Two preferences are kept in your browser: your light/dark theme choice and your analytics decision. They never leave your device. No cookies are set for visitors — the only cookie this site can set is a short-lived one that protects the owner's login flow, and visitors never receive it.
Analytics — only with your consent
Pressing "Accept" on the cookie notice loads the site's analytics, provided by Umami. Until that moment, nothing is measured.
The analytics are cookieless: they record the page you're on, the page you came from, your approximate country, and your browser and device in broad strokes. No cookies, no cross-site tracking, no fingerprinting, and raw IP addresses aren't stored. I also count a few anonymous events — like light/dark theme switches — plain counters with no identifiers attached.
Changing your mind: use Cookie settings in the footer (or clear this site's data in your browser). That withdraws your acceptance immediately, and the analytics stop loading on your visits. Data already sent can be deleted on request — see Umami's privacy policy. The legal basis for analytics is your consent.
Embedded content
Some posts embed third-party media. Each is set up to contact its provider as little as possible — but once an embed loads, that provider sees your IP address and user agent, and their own privacy terms apply.
- YouTube — loaded in privacy-enhanced mode: Google sees your IP when the player loads, but tracking cookies are only set after you press play. Google's privacy policy
- X/Twitter — posts appear as static snapshots, so viewing the page sends nothing to X. Only in rare fallbacks does the widget load, with do-not-track enabled. X's privacy policy
- Instagram — the embed only loads when the post scrolls into view; until then, nothing is sent. Meta's privacy policy
Fonts
The site's web fonts come from Google's CDN, so Google sees your IP address when they load. Serving the site this way is covered by legitimate interest; self-hosting the fonts would remove this third-party contact entirely, and it's on the roadmap.
Hosting & logs
The site is served by Cloudflare Pages. Cloudflare processes standard request metadata (including your IP address) transiently to deliver the site and protect it from abuse — see Cloudflare's privacy policy. I keep no server logs of my own.
What this site never does
No accounts, no comments, no newsletters, no advertising, no profiling, and no selling or sharing of visitor data — there is none to share.
Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection, plus the right to complain to your local supervisory authority. Because the site itself stores almost nothing about you, most requests concern third parties (Umami, Cloudflare) — email [email protected] and I'll help or point you to the right one.
Security
How to report a vulnerability — and what's in scope — is described in the security policy.
Changes to this policy
If what this site collects ever changes, this page will say so — the date below is the commit point.
Last updated 2026-09-05.