Privacy

What is collected

Every request to this site is recorded: pages, files, redirects, errors and the admin pages alike. Each record holds:

• the time
• the address you asked for, including anything after a question mark
• the kind of request (GET, POST and so on) and the status code the site answered with
• the address of the page you came from, as your browser sent it, and that site's name
• your IP address
• your browser string (the User-Agent), and the operating system, browser and type of device read from it
• the languages your browser says you prefer
• how your browser says the request was made: opening a page, or fetching something for one
• your country, region, city and network operator, which Cloudflare works out from your IP address
• which Cloudflare data centre served you
• a bot name, if the request looks automated
• a visitor identifier
• on pages, what the small script reports

The visitor identifier

The identifier is a keyed hash of your IP address and browser string. The key is a secret kept on the server, and without it the identifier cannot be turned back into either. It stays the same from day to day, so a return visit from the same connection and the same browser is recognised as the same visitor. A different network or a browser update gives a new one; people sharing a connection and an identical browser share one. The site owner can attach a name and a note to an identifier.

The small script

On pages, one inline script measures how long the page was visible, how far down it was scrolled and which sections came into view, and sends that back when you leave or hide the page. The result is added to that page's record. The script does nothing if your browser sends Do Not Track or Global Privacy Control.

Opting out

If your browser sends Global Privacy Control or Do Not Track, this site takes that as your objection. The request is still counted, but its record leaves out your IP address, browser string and identifier, your languages, your region, city and network operator, the data centre that served you, anything after a question mark, and the full address of the page you came from. The small script does nothing. Cloudflare's own records, below, are not affected.

The bot check

The pages under /about hold personal details, so Cloudflare checks that a visitor there is a browser rather than a bulk scraper. Most browsers pass without noticing; some see a short "verifying" page first. Passing sets one cookie, cf_clearance, which tells Cloudflare the check was passed. It is valid for 30 minutes, and this site never reads it. Crawlers that Cloudflare has verified, such as search engines, skip the check; archivers, such as the Internet Archive's, do not.

What is not done

This site sets no cookie for a visitor. The two it does set are the site owner's: one for signing in to the admin pages, and one that keeps the site owner's own visits out of the statistics. The bot check above sets Cloudflare's, which this site never reads. There is no third-party analytics, no advertising, and no cross-site tracking.

Who and why

The controller is Bahadır Gezer. All of this is collected so the site owner knows who reads the site and what they read, and can see automated and malicious traffic. The legal basis is legitimate interest. The processor is Cloudflare, Inc., which hosts the site. Cloudflare also keeps two records of its own, both of which the site owner can read: a log of every request, including your IP address and the headers your browser sent, for up to 7 days, and its traffic records, with your IP address and the address you asked for, for 31 days.

Your rights

You can ask to see what is recorded about you, to have it deleted, or to object to it, by writing to the email address on /about. Include your IP address and roughly when you visited, so your records can be found. Your message is held by Zoho, which hosts the mailbox in the EU. You can also complain to your national data protection authority; in Belgium, where this site is run, that is the Gegevensbeschermingsautoriteit (Data Protection Authority).

Retention

Every record, with your IP address, browser string and identifier on it, is deleted 13 months after the request that made it. Nothing is removed from a record before then. Cloudflare's request log is kept for up to 7 days, and its traffic records for 31.