Privacy
This is a personal blog. It has no analytics, no ads, no tracking and no cookie banner, because there is nothing to consent to. The only personal data it handles is listed below.
Who is responsible
Paolo Bietolini, privacy@paolobietolini.com. Write to this address for any question or request about your data.
Hosting
The site and the comments run on my own server at Infomaniak in Switzerland. Switzerland is recognised by the EU as providing an adequate level of data protection.
Reading the blog
- No cookies. If you use the light/dark switch, your choice is saved in your browser's local storage. It never leaves your device.
- Server logs record only failed requests (pages not found, blocked or failed requests): IP address, time, requested address and browser identifier. Successful page views are not logged. These logs are kept for 7 days to detect abuse and fix errors, then deleted (legitimate interest, Art. 6(1)(f) GDPR).
- The comments section loads from
comments.paolobietolini.com, which is the same server. No third-party service is contacted while you read.
Comments
Comments use Remark42, self-hosted on the server above. Commenting is optional. When you comment, this is stored:
- the name you choose, your comment, the page and the time;
- a scrambled (hashed) version of your IP address, used only to fight spam and abuse. The original address is not stored;
- if you sign in with email: your email address, linked to your account. It is used to send you a one-time login code and is never shown publicly.
Login emails are sent through mailbox.org(Heinlein Hosting GmbH, Germany), my email provider.
Profile pictures: when you sign in with email, the comments server asksGravatar (Automattic Inc., USA) whether a picture exists for a scrambled (hashed) form of your email address. If none exists, a generated picture is used. Your browser does not contact Gravatar; the request comes from my server.
Cookies: only after you sign in, comments.paolobietolini.com sets two cookies (JWT and XSRF-TOKEN) that keep you logged in and protect the form. They are strictly necessary for the login you asked for. The comments widget may also keep display settings, such as sort order, in your browser's local storage.
Legal basis: your request to publish a comment (Art. 6(1)(b) GDPR). Spam protection relies on legitimate interest (Art. 6(1)(f)).
How long: comments stay as long as they are published. You can ask me to delete your comments or your whole account at any time. Backups of the comments database are kept for7 days, so deleted data disappears from backups within a week.
Your rights
You can ask for a copy of your data, its correction or deletion, and you can object to or restrict its processing. Email privacy@paolobietolini.com and I'll reply within 30 days. You also have the right to complain to a data protection authority.