Privacy

What happens to your data when you visit this site, write to me, or book a call. This notice follows Article 13 of the GDPR.

Mykola Korzh runs this site and is the controller under the GDPR. My postal address is in the imprint. For anything about your data, write to hello@mykolakorzh.com.

I have not appointed a data protection officer, because the law does not require one here.

Where I process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Article 21 GDPR). I then stop, unless I can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims. An email to the address above is enough.

This site runs on Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Every request to the site passes through Cloudflare's network. To deliver a page, Cloudflare processes your IP address, the page you asked for, the time, your browser's user agent and the referring page.

Request logging is switched on for the site, so these request details are also kept in logs for a short time. I use them only to find errors and to keep the site secure, and they are deleted automatically.

Cloudflare also uses request data to protect the site against attacks and abuse.

Cloudflare acts as my processor under a data processing agreement. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in delivering the site reliably and keeping it secure.

I count visits with Cloudflare Web Analytics, so I can see how many people read which page and which site sent them. Cloudflare adds a small script to each page. It sends the page address, the referring page, load timings and basic device and browser information to this site's own address (/cdn-cgi/rum), where Cloudflare receives it.

According to Cloudflare, the script uses no cookies and no local storage and does not fingerprint visitors. I see only totals, such as page views per page and per referring site. I cannot follow a single visitor or recognise you on a later visit.

The legal basis is Article 6(1)(f) GDPR: my legitimate interest in knowing, in aggregate, how the site is used. You can object at any time (see above), and you can also block the script with a content blocker without losing anything on the site.

The site's own code sets no cookies. It keeps a few small values in your browser's storage. They never leave your browser by themselves, and you can delete them at any time in your browser's settings.

• Your color scheme, if you pick light or dark in the appearance menu (local storage, key personal-os:color-scheme:v1). Choosing System removes it.
• Your scroll position in the home feed, so Back returns you to the same place (session storage, deleted when you close the tab).
• A short link label, if you arrived through a link that carries one, such as ?via=newsletter (session storage, deleted when you close the tab). It names the link, not you. It is used only if you write to me or book a call, as described below.
• In the demo apps under /lab: BrewEasy keeps your brew log and sound setting (local storage), and Original Gravity keeps the beers you put on your tab (local storage) and whether you have already seen its intro animations (session storage).

Storing and reading these values is necessary to provide what you asked for, such as keeping a setting you chose (§ 25(2) No. 2 TDDDG).

When you write to hello@mykolakorzh.com, I receive your email address, your name if you give it, and whatever you write. If you arrived through a link with a link label, the email draft your mail program opens already has that label in its subject line, for example "(via newsletter)". You can delete it before sending.

I use your message only to answer you and, if we work together, to prepare and carry out that work. The legal basis is Article 6(1)(b) GDPR where your message is about a possible project, and Article 6(1)(f) GDPR, my legitimate interest in answering you, for everything else.

My email is hosted by Google Workspace, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as my processor under a data processing agreement. Google may also process the data in the United States.

I delete an email conversation when it is no longer needed for the purpose it was sent for. Where tax law requires me to keep records, such as correspondence connected to a contract or an invoice, I keep them for the period it sets and then delete them.

You can book an intro call through Cal.com, a scheduling service of Cal.com, Inc., USA. Nothing is sent to Cal.com while you only read the site. When you click the booking button, your browser loads Cal.com's script and booking window from app.cal.com and shows the booking over the page. If that does not work, or you open the link in a new tab, you go to cal.com directly.

From that moment Cal.com receives your IP address and browser details, and, when you book, the name, email address and any notes you enter. If you arrived through a link with a link label, the label is passed to Cal.com with the booking, so I can see which link the booking came from.

I use the booking only to hold the call and prepare for it. The legal basis is Article 6(1)(b) GDPR, steps taken at your request before a possible contract. Cal.com processes the data in its own systems, possibly in the United States. Cal.com's own privacy policy explains how.

The copies of my Eidos newsletter editions under /writing show their pictures from Substack's image server (substackcdn.com), run by Substack, Inc., USA, and one picture from images.unsplash.com, run by Unsplash. When your browser loads them, those servers receive your IP address, the time and the address of the page you are on. Apart from the booking window described above, every other page, including the demo apps under /lab, loads its fonts and files from this site only.

The legal basis is Article 6(1)(f) GDPR: my legitimate interest in showing these pages as they were made. These providers may process the data in the United States.

The newsletter list on the home page is read from Substack by my server, not by your browser, so loading the home page sends nothing about you to Substack.

Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework. Transfers to them rest on the European Commission's adequacy decision for that framework (Article 45 GDPR). For the other providers named above, their own privacy policies describe how they protect data they process in the United States.

I keep personal data only as long as the purpose needs it, and longer only where the law requires it. Server logs are deleted automatically after a short time. Visit statistics contain no personal data I can see. Emails and bookings follow the rules in their sections above.

You have the right to:

• get a copy of the data I hold about you and learn how I use it (Article 15 GDPR)
• have wrong data corrected (Article 16 GDPR)
• have your data deleted (Article 17 GDPR)
• have its processing restricted (Article 18 GDPR)
• receive the data you gave me in a common, machine-readable format (Article 20 GDPR)
• object to processing based on legitimate interests (Article 21 GDPR, see above)

To use any of these rights, write to hello@mykolakorzh.com.

You can complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the law was broken. The authority responsible for me is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

You are not obliged to give me any personal data. Without your email address I cannot answer you, and without your booking details I cannot hold a call.

I make no decisions about you by automated means, including profiling (Article 22 GDPR).