How I Handle Your Data.

I use a self-hosted installation of Umami to understand which pages and links are useful. The statistics are not used for advertising, selling data or tracking people across websites.

Umami uses no cookies. Session replay, heatmaps and identified user profiles are disabled. Do Not Track is respected.

• Visited page and page title. URL parameters and hash values are removed.
• Referring domain and page, timestamp and specifically marked link clicks.
• Browser, operating system, device type, screen size and language.
• Approximate country, region and city derived from the IP address.
• A monthly session ID calculated from the IP address, user-agent, website ID and a secret salt.

The IP address is used temporarily for geolocation and session calculation but is not stored in Umami. The raw user-agent is not stored either. The GDPR legal basis is my legitimate interest in improving and operating the website with measurement that is as limited and self-controlled as possible.

Raw visitor data in Umami is deleted automatically after 90 days. Access-controlled recovery copies are rotated after 7 days, which means a record may remain there for at most about 97 days.

The web server’s separate operational log is kept for no more than 30 days. It is used for security, troubleshooting and capacity planning.

The Caddy web server logs the timestamp, requested address, method, response status, user-agent and a masked network address. IPv4 addresses are masked to /24 and IPv6 addresses to /48 before being written to disk. Cookie and Authorization headers are not stored.

The logs are not used for marketing or visitor profiles. The legal basis is my legitimate interest in protecting and operating the service.

If you email me, I process the contact details and content you provide to reply and handle your request. The information is kept for as long as needed for the conversation, a possible agreement or legal duties such as accounting.

The website and Umami run on my server at Hetzner within the EU/EEA. Necessary providers may process data for hosting and email, but I do not sell data or share it with advertising networks. No automated profiling or decision-making is used.

You may request access, correction, deletion or restriction and object to processing based on legitimate interests. Because Umami stores neither names nor IP addresses, I may sometimes be unable to connect an individual analytics record to you.

You may also lodge a complaint with the Swedish Authority for Privacy Protection. Feel free to contact me first and I will try to resolve the matter directly.