privacy notice
this website is a personal, non-commercial blog. it uses no analytics, no advertising and no tracking. this notice explains what personal data is processed when you use it, and the rights you have under the gdpr.
1. who is responsible
the controller responsible for data processing on this website is:
aeilko
email: mail@blog.slightly-askew.com
2. visiting the site
when you open a page, your browser sends your ip address and the usual request details (time, the page requested, browser type, referring page) to the server. this is unavoidable for any website: the server needs your ip address to send the response back and to terminate the https connection. this data is used only to deliver the site and keep it secure, and is processed transiently.
the site keeps no access logs — there is no per-visit record of ip addresses or requests. the application and the reverse proxy write only operational messages (startup, errors, certificate renewals) to a self-hosted log system (grafana loki) that is not reachable from the internet and is not shared with anyone. these entries are deleted after 30 days; they normally contain no personal data, though an occasional error message may include an ip address.
the site is hosted on servers of hetzner online gmbh, germany, which processes the above data solely as a processor on the controller's behalf, on the basis of a data processing agreement pursuant to Art. 28 GDPR. as hetzner operates within germany, no transfer to a third country takes place for hosting. https connections are secured with certificates issued by let's encrypt (internet security research group, usa).
legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, secure website).
3. fonts
the site's fonts are bundled into the site when it is built and served from this domain along with the rest of the page. your browser does not contact any font provider or content delivery network to display text, and no data is shared with a third party for this purpose.
4. the videos page
the videos page shows videos from youtube. the preview images are fetched by this site's own server and served from this domain, so opening the page creates no connection between your browser and youtube.
only when you click a preview to start a video is an embedded player loaded, from youtube-nocookie.com. from that moment your ip address is sent to youtube and it may process data on servers operated by google ireland limited (ireland) and google llc (usa); the operator of this site has no influence over that processing. the youtube-nocookie variant does not store cookies for audience measurement unless you interact further with the player. details are in google's privacy policy.
no youtube content is loaded on any other page, and none is loaded until you start a video.
legal basis: Art. 6(1)(a) GDPR (consent, given by starting a video).
5. the notes page
the notes page is a shared wall of sticky notes. whatever you post there — the note text, and a name if you choose to give one — is public and stays on the board for everyone to see. don't put anything sensitive in a note; a nickname is fine. any visitor can drag any note to a new position.
so that you can edit or delete a note you posted, your browser keeps one random identifier in its local storage. the server stores only a salted hash of it, never the value itself, and uses it for nothing except checking that an edit or deletion comes from whoever wrote the note. it is not an account and does not identify you. an optional edit link carries the same identifier in the part of the address after the “#”, which browsers never send to the server. clearing your browser data removes the identifier, after which older notes can no longer be edited from that browser.
the page holds a websocket connection open so notes update live. the notes are stored in a database on the same server as the site (section 2) and are not passed to any third party.
legal basis: Art. 6(1)(a) GDPR (consent, given by posting a note); for the identifier, Art. 6(1)(f) GDPR, as it is required to let you manage your own notes.
6. newsletter
you can subscribe to receive an email when a new blog post is published. to do this the site stores your email address, a random confirmation token, whether the subscription is confirmed, and the relevant timestamps. a confirmation email is sent first (double opt-in); your address is only added to the list once you click the link in it. the site also keeps a record of which posts have already been sent (post identifier and time only, no personal data).
the emails themselves are sent through resend (resend, inc., usa), which processes your email address as a processor in order to deliver the messages.
every newsletter email contains an unsubscribe link. when you unsubscribe, your address is removed. you can also ask the controller to remove it at any time.
legal basis: Art. 6(1)(a) GDPR (consent). you may withdraw your consent at any time with effect for the future; this does not affect processing that already took place.
7. contacting me by email
if you write to the address published on the site, your message reaches the operator via resend's inbound email service and is forwarded to a private mailbox. your email address, your name if you give it, and the content of your message are processed solely to handle your enquiry, and are kept for as long as that requires and any applicable retention obligations.
legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where your message concerns a contract or its preparation.
8. cookies and local storage
this site sets no cookies of its own and uses no browser storage for tracking or advertising. the notes page keeps one functional identifier in local storage, described in section 5. the only third party that may set cookies is youtube, and only after you start a video on the videos page (see section 4).
9. who your data is shared with
personal data is only passed to the processors and services named above: the hosting provider (section 2), let's encrypt (section 2), youtube / google (section 4, only if you start a video) and resend (sections 6 and 7). notes you post stay on the site's own server (section 5). data is never sold or used for advertising.
resend, inc. and google llc are located in the usa. both are self-certified under the eu–u.s. data privacy framework, which is the basis for these transfers. let's encrypt processes data under an appropriate safeguard.
10. how long data is kept
- operational log messages (grafana loki): 30 days.
- notes: until you or the operator delete them (no automatic expiry).
- newsletter subscription: until you unsubscribe or ask for removal.
- email correspondence: until your enquiry is settled, plus any statutory retention period.
11. your rights
under the gdpr you have the right to:
- access the personal data held about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- have processing restricted (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw any consent you have given, with effect for the future (Art. 7(3)).
to exercise any of these, email the controller at the address in section 1.
12. complaints
if you believe your data is being processed unlawfully, you may lodge a complaint with a data protection supervisory authority, in particular the one for your place of residence or work, or the authority competent for the controller: Berliner Beauftragte für Datenschutz und Informationsfreiheit
13. changes to this notice
this notice may be updated when the site or the services it relies on change. the date at the top always shows the current version.