Privacy // KUBA SZWAJKA

What this site collects when you read it, sign up for the newsletter or write to me, and why.

Who I am

I'm Jakub Szwajka. I run kubaszwajka.com as a private person, and I am the controller of the personal data this notice covers: the visit counts on this site, the newsletter and the work-with-me form. This notice follows Article 13 of the GDPR.

Write to me about anything on this page at [email protected]. Contact is by email only. I have no data protection officer.

In short

Basic statistics without cookies run for every visitor. They count page views and clicks.
Session replays, heatmaps and page speed reports run only if you allow analytics in the banner. You can change that any time under Privacy settings, at the bottom of every page.
If you sign up for the newsletter, Kit keeps your email address and sends the mails.
If you use the work-with-me form, your message reaches my mailbox through Resend.
I sell nothing, and I load no ad or marketing trackers.

Visit counts for every visitor

Every page loads one script from analytics.niuluc.me. It starts Umami, the analytics tool I host myself on servers I rent from Hetzner Online GmbH. Umami counts page views and a fixed set of clicks for every visitor, before and without any choice in the banner. It sets no cookies.

With each page view or event, Umami receives:

the page address, after your browser cleans it (see below);
the page title;
the referrer, the page you came from, cleaned the same way;
your screen size and browser language;
the hostname of this site;
for an event, its name and its fixed details.

My Umami server also reads your IP address and your browser's user agent from each request. From them it works out your country, region and city, and your browser, operating system and device type, and stores those. The IP address and the user agent are used to build a session id, so page views from one visit count as one session. They are not stored. I treat the session id as personal data, because with the server's secret it can be rebuilt from an IP address and a browser.

Your browser cleans every address before it is sent. It keeps the path. It drops the part after # and every query parameter except the campaign tags utm_source, utm_medium, utm_campaign, utm_content and utm_term. It replaces with "redacted" any part of the path that looks like an id or holds an email-like or encoded value, and drops a campaign tag that looks like one.

The events are clicks on links that leave the site (outbound_link_click, social_click, project_click), on contact and download links (contact_click, download_click), on post actions (article_action_click) and on the way to the work-with-me form (wwm_entry_click); the newsletter bar and sign-up (newsletter_bar_view, newsletter_bar_dismiss, newsletter_subscribe, newsletter_subscribe_error); and the form itself (wwm_choice, wwm_form_start, wwm_form_submit). Their details hold only fixed values: where on the page the link sits, its label, the site and path it leads to, the page path and the option you picked. They never hold what you type.

If your browser sends Do Not Track, it sends nothing to Umami.

Legal basis: my legitimate interest, Art. 6(1)(f) GDPR. The interest: to know which posts people read, where they come from and which links they use, so I can decide what to write and fix what does not work. You can object to it at any time; see Your rights.

I keep the visit and event data for 25 months, then it is deleted. Nobody else gets it for their own use.

Session replays, heatmaps and page speed, only with your consent

If you choose Accept in the banner, or turn on Analytics under Privacy settings, your browser also sends these to the same Umami server:

Session replays. A recording of how the page looked and changed while you used it: the page text and layout, mouse movement, clicks, scrolling and window size. Form fields are always masked, so what you type into them is not recorded. On the contact form, the summary next to the questions and the confirmation after you send repeat what you typed, so both are hidden from recordings. Drawings on a canvas and frames from other sites are not recorded.
Heatmaps. Where on the page you click, and how far down you scroll.
Page speed reports. How fast the page loads and responds.

They are tied to the same session id as the visit counts. I use them to see where a page confuses people or loads slowly.

Legal basis: your consent, Art. 6(1)(a) GDPR. Without consent, or after you reject, none of this runs, and the visit counts above go on. I keep replays, heatmaps and reports for 25 months, then they are deleted.

You can withdraw consent at any time under Privacy settings, at the bottom of every page: choose Withdraw consent or Reject. Withdrawal stops the recording from then on. It does not delete what was already sent. To have that deleted, email me.

What the site keeps in your browser

This site keeps these entries in your browser's storage:

utati.consent.v1.0d3222ac-87c7-4111-9cf5-8eed95ec39dd, in localStorage and sessionStorage: the random browser key and your choice in the banner. It is needed to remember your choice. It stays until you clear site data. Your choice in it expires after 365 days, and then the banner asks again. The server side of the key is described above.
newsletter:subscribed, in localStorage: set to 1 after you sign up here, so the sign-up bar stops showing. It stays until you clear site data.
newsletter:dismissed-at, in localStorage: the time you closed the newsletter bar, so it stays hidden for 60 days. It stays until you clear site data.

The two newsletter entries remember what you did on the page and never leave your browser. Umami reads one entry, umami.disabled, which this site never writes, and keeps its session token in memory only. Neither this site nor Umami sets cookies.

When the work-with-me form is switched on, its spam check runs in a frame from Cloudflare. Anything it stores sits under Cloudflare's domain; Cloudflare describes it in its Turnstile privacy notice and cookie policy.

The work-with-me form

What the form sends

When you press Send, your browser posts these fields to studio.kubaszwajka.com/api/contact:

your email address;
your message;
your name, if you give it;
which option you picked, engineer or business;
a token from the Cloudflare Turnstile spam check.

The server also sees your IP address, like any web server. Please leave private code, customer data and other people's personal data out of the message.

Sometimes the form is not switched on. Then Send opens a draft in your own email app, and no data leaves your browser until you send that email yourself. It goes to [email protected], which forwards it to my mailbox like any other email.

What happens after you press Send

Turnstile checks in your browser that you are a person. Cloudflare sees your IP address and signals from your browser for this.
The server asks Cloudflare whether the Turnstile token is valid.
The server counts messages per IP address in its memory, to limit how many one address can send.
It sends one email with your message to my mailbox through Resend.
It posts a one-line note to my Discord: a new enquiry came in, engineer or business. The note has no message, name, email or IP address in it.

Nothing goes into a database. The server does not log your message, email, name or IP address.

Legal bases

Visit counts for every visitor: Art. 6(1)(f) GDPR. My legitimate interest is to know what people read and use on this site.
Session replays, heatmaps and page speed reports: Art. 6(1)(a) GDPR, your consent in the banner.
The record of your choice in the banner: Art. 6(1)(c) with Art. 7(1) GDPR. I must be able to prove consent.
The browser key on the consent server: Art. 6(1)(f) GDPR before you choose: to show the banner, record your choice and stop abuse. After you choose, Art. 6(1)(c) with Art. 7(1) GDPR.
The newsletter: Art. 6(1)(a) GDPR, your consent when you sign up.
Answering an enquiry about a paid service (a workflow review or a process discovery): Art. 6(1)(b) GDPR. You ask me to take a step before a possible contract: reply, then agree scope and price.
Answering any other message: Art. 6(1)(f) GDPR. My legitimate interest is to answer people who write to me.
Keeping spam and abuse out of the form: Art. 6(1)(f) GDPR. My legitimate interest is to keep the form usable. This uses your IP address and the Turnstile token.

Who else gets your data

Hetzner Online GmbH rents me the servers this site, the form's server, Umami and Utati run on.
analytics.niuluc.me is my own Umami and Utati. It receives the visit counts, the replays, heatmaps and reports you allow, and the records of your choices. No third party gets them for its own use.
Cloudflare, Inc. sits in front of this site and studio.kubaszwajka.com, so your requests pass through its network. It runs the Turnstile check. Its Turnstile privacy notice says it processes the signals for me, and also uses them on its own account to improve its bot detection. It also forwards mail sent to [email protected] on to my mailbox.
Kit, Inc. keeps the newsletter list and sends the newsletter, under its data processing addendum.
Resend (Plus Five Five, Inc.) sends the email with your message to me. It works for me under its data processing addendum.
Google runs Gmail, where my mailbox is. Your message and our emails end up there. See Google's privacy policy.
Discord gets only the one-line note about a new enquiry. It gets no personal data.

I do not sell your data. I pass it to authorities only when the law requires it, or to defend a claim.

Transfers outside the EEA

Cloudflare is a US company. It is certified under the EU-U.S. Data Privacy Framework, and its data processing addendum adds the EU standard contractual clauses (source).
Kit is based in the United States and stores data there. Kit says it relies on the EU-U.S. Data Privacy Framework, and its data processing addendum includes the EU standard contractual clauses (source).
Resend sends the email from its Ireland region, but it stores account data, email metadata and logs in the United States. Its data processing addendum covers that transfer with the EU standard contractual clauses.
Google may process mail on servers outside your country. Google says it relies on the EU-U.S. Data Privacy Framework for this (source).

How long I keep it

Umami visit and event data: 25 months, then deleted.
Session replays, heatmaps and page speed reports: 25 months, then deleted.
Records of your choices in the banner: 5 years from the choice.
The browser key on the consent server: 30 days if you make no choice. Once you choose, as long as the records of your choices that point to it, 5 years.
Your choice in the banner: 365 days, then the banner asks again.
Your newsletter address in Kit: while you are subscribed. After you unsubscribe, Kit keeps it marked as unsubscribed, so you are not emailed again. Write to me and I delete the address and its history from Kit.
Your enquiry and our emails: 12 months after our last contact. Then I delete them.
The per-IP count for the form: each count covers one hour. It lives only in the server's memory, it is never written to disk, and a restart wipes it.
Resend keeps its record of sent emails for 30 days on its standard plans (source).
The entries in your browser: until you clear site data, as listed above.

Your rights

You have the right to:

see your data and get a copy;
have it corrected;
have it erased;
restrict how I use it;
get the data you gave me in a portable format, where I rely on consent or on Art. 6(1)(b).

Email me at [email protected] to use any of them.

Your right to object. You can object at any time to any use that rests on my legitimate interest, Art. 6(1)(f), such as the visit counts. To stop the visit counts at once, turn on Do Not Track in your browser: with it on, your browser sends nothing to Umami. For anything else, email me.

Withdrawing consent. Open Privacy settings, also at the bottom of every page, and choose Withdraw consent or Reject. To leave the newsletter, use the unsubscribe link in any email. Withdrawal stops the processing from then on. It does not make earlier processing unlawful.

You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl. You can also complain to the authority in the EU country where you live or work.

Do you have to give me your data?

No. Writing to me and signing up for the newsletter are voluntary. Without an email address and a message I can't answer you, and without an email address I can't send you the newsletter. Your name is optional.

Automated decisions

I make no decisions about you by automated means alone, and I do no profiling. The Turnstile check only decides whether the form accepts a message.

Changes to this notice

This notice applies from 5 November 2026. When it changes, the date at the top changes too.

Privacy notice