privacy

i wrote a whole post about how the consent banner is the loading screen of the modern web. it would be rude to then hand you one. so here is the entire privacy policy, in plain language.

the short version

no cookies, no ad tech, no profile of you sitting anywhere. one analytics script, and it is a cookieless one. there is no banner because nothing here stores anything on your device that you didn’t ask for.

what runs on this page

the fonts, the stylesheet and the one javascript file are all served from krtffl.dev. no cdn, no google fonts, no tag manager, no embedded video, no social widgets.

the exception is the analytics beacon:

html
<script defer src="https://static.cloudflareinsights.com/beacon.min.js"></script>

open your network tab and count the domains: there are two, krtffl.dev and cloudflareinsights.com. i would rather write that sentence than the one where i quietly round it down to one.

the analytics, specifically

that beacon ships in this site’s own <head> template. cloudflare used to inject it during its build; it moved into the template when deploys moved to a direct upload, which skips that step entirely — left alone, the beacon would have quietly vanished and this section would have been describing a script that was no longer there. what reaches my dashboard is aggregate: page path, referrer host, country, browser, operating system, device type, and the load timings cloudflare calls core web vitals. no visitor id, no heatmap, no session replay, nothing that follows you to the next site.

what it does not do — measured on this page rather than taken on faith: it sets no cookie and writes nothing to localStorage. load this page with devtools open and the storage tab stays empty until you touch the theme toggle. cloudflare’s own account of the product is in their docs ↗ , and their processing sits under their privacy policy ↗ .

the bar for anything third-party on this page is that it works without a cookie, without an identifier, and without following you to the next site. this clears that bar. a great deal of analytics does not. if it ever stops clearing it, it comes off, and this section goes with it.

what gets stored on your device

one thing, and only if you ask for it:

k-theme — a localStorage entry holding "light" or "dark", written when you hit the theme toggle (or press t). it exists so the site doesn’t flash the wrong colour scheme on your next visit. it is not an identifier, it never leaves your browser, and nothing reads it but the stylesheet.

under the eprivacy directive — article 5(3), article 22 of the spanish lssi — storage that’s strictly necessary to deliver something you explicitly asked for doesn’t require consent. you asked for dark mode; this remembers dark mode. clear your site data and it’s gone.

the analytics beacon adds nothing to this list. that is the entire reason it’s the one i picked: article 5(3) is about reading and writing on your device, and a script that does neither has nothing to ask you about.

what the server knows

krtffl.dev is static files on cloudflare pages. every page you read is a file; nothing on this site runs server-side code to render it. there are three dormant endpoints under /api/ left over from the newsletter above — nothing links to them, and with no database attached they refuse every request instead of storing anything.

cloudflare, as the host, processes your ip address to actually deliver the page and to absorb attacks. that’s their processing, under their privacy policy ↗ , and it’s the same thing every web server on earth does. i don’t run any request logging on top of it.

what i do have is the aggregate dashboard described above. so i can tell you that forty people read a post last tuesday and roughly where they were — and nothing whatsoever about which forty.

the form at the bottom of posts

the reply box composes an email in your email client and sends nothing on its own — if you never hit send, i never see it.

there is no subscribe box. there was going to be one, and the code for it is written and sitting in this repo — but it needs a paid plan to send the confirmation email, and i haven’t decided that’s worth it yet. rather than leave a form on the page that takes your address and then fails, i took the form off the page. nothing on this site currently collects an email address from you.

if that changes, this section changes with it, and it will say exactly what gets stored and for how long before you’re asked to type anything.

the support button

the ko-fi link is a plain link. no script, no cookie, no pixel — nothing about ko-fi touches this page until you click through. once you’re on ko-fi.com you’re on their site under their privacy policy ↗ , and they handle the payment end to end. i never see your card details, and the only thing that reaches me is a name and whatever note you choose to leave.

outbound links

links to github, ko-fi, didacperezescrich.com and anywhere else are ordinary links. those sites have their own rules. i have no control over them and no visibility into what you do once you leave.

your rights, briefly

i hold no record that identifies you. there is no account system, no mailing list, and the analytics is aggregate — there is no row with your name on it to hand over, correct, or delete, because there is no row.

if you’ve emailed me, i have that email in my inbox like any other — ask and i’ll delete it.

questions, or think i’ve got something wrong here: [email protected] .