Who is responsible for your data
The controller is Tom Chmiel, trading as Tomasz Chmiel, NIP/VAT EU: PL8733028317 ul. Zimna Woda 18, 33-112 Tarnowiec, Poland. You can reach me at hello@etchdeveloper.com for anything related to this policy or your data.
The short version
Browsing the site sets no cookies. A cookie is set only if you leave a comment and tick “Save my name, email, and website in this browser”, or if Cloudflare has to check that your browser is not a bot.
- Visits are counted with Umami, an analytics tool I host myself. It uses no cookies, stores no IP addresses and does not follow you to other sites.
- Forms and the newsletter collect only what they ask for, and I use it only for the purpose you sent it for. Your address goes on the newsletter list only after you confirm it, and leaves it the moment you unsubscribe.
- I don't sell data, show ads or run advertising trackers.
What I collect and why
Visiting the site
When you open a page, the web server and Cloudflare, which sits in front of it, log the request: your IP address, the date and time, the page requested, the referring page and your browser's user agent string. I use these logs to keep the site running, to find errors and to block abuse. Server logs are kept for 30 days and then deleted. The legal basis is my legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
The site is hosted on a server in Germany (EU) that I manage myself. Cloudflare, Inc. provides the content delivery network and protection against attacks and processes connection data on my behalf; see Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.
Analytics
I use Umami, an open-source analytics tool, hosted on my own server at stats.tomchmiel.com in Germany. It records the page you viewed, the page you came from, your browser, operating system, device type, screen size, the country derived from your IP address and clicks on the copy and download buttons. Umami does not store the IP address itself and sets no cookies. To tell one visit from another it uses a hash of your IP address and user agent together with a salt that rotates monthly, so a visitor cannot be recognized from one period to the next. The data is aggregated and tells me which pages and components people use. The legal basis is my legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR). Analytics data is kept indefinitely in aggregated form.
Newsletter
If you subscribe, I store your name and email address, together with the date and the consent you gave. After you submit the form you get an email with a confirmation link, and the subscription starts only when you click it. I use the address to send the emails described in the signup form: new components, plugins, snippets, versions and articles. The emails contain no tracking pixels, and I don't log who opened them.
Subscriptions are stored in WordPress on my server and sent from my own newsletter server; both run in Germany (EU). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in every email or by writing to me. After you unsubscribe, your address is deleted right away.
Contact and project forms
The contact form and the project form on the Hire me page ask for your name, your email address, optionally your phone number, and your message. I use them only to answer you and, if we start working together, to prepare and carry out the project. Submissions are stored in the website's database on my server (the forms use WS Form), and I reply from my mailbox at Fastmail Pty Ltd (Australia): my mailbox, where your emails arrive and from which I answer form messages. The primary copy is stored in Fastmail’s EU region (Amsterdam, the Netherlands); replicas, backups and some logs are kept in the United States. The legal basis is your request before a contract and my legitimate interest in answering messages (Art. 6(1)(b) and (f) GDPR). Messages that don't lead to a project are deleted 12 months after our last exchange. Correspondence that belongs to a project is kept as long as the law on accounting and contracts requires.
Feedback forms on component pages
Each component page has a form for bug reports and suggestions. It asks what the report is about, your message, optionally the versions of Etch and WordPress you use, and your email address so I can reply or tell you when a fix is out. The form also sends the name and version of the component and the address of the page. The data is stored in the website's database on my server, used only to handle the report, and deleted 12 months after the report is closed. The legal basis is my legitimate interest in fixing the files I publish (Art. 6(1)(f) GDPR).
Comments
If you comment on an article, WordPress stores the name, email address and optional website you enter, the comment itself, your IP address and your browser's user agent string. The IP address and user agent help to detect spam. The email address is never published. Comments are checked for spam by WP Armour, a honeypot that runs on my server and sends nothing to third parties. Comments and their metadata are kept for as long as the article is online, so that follow-up comments from the same person can be approved automatically. You can ask me to delete your comments at any time.
If you tick "Save my name, email, and website in this browser for the next time I comment", WordPress stores those details in cookies in your browser for one year. They are set only when you tick the box.
An anonymized hash of your email address is sent to the Gravatar service to check whether you have a profile picture there. Gravatar is run by Automattic Inc.; see https://automattic.com/privacy/. After approval, your profile picture is shown next to your comment.
The legal basis for comments is my legitimate interest in running a discussion under the articles (Art. 6(1)(f) GDPR).
Downloads and plugin updates
Downloading a component file or a plugin needs no account and records nothing beyond the server log described above and an anonymous download count in Umami. If you install the Link Picker plugin, your WordPress site checks etchdeveloper.com for updates like it does for other plugins. That request includes only the plugin version, in the user agent string, and no site address, content or user data. The server uses it only to answer with the right update and does not store it beyond the server log.
Links to other sites
The site links to Ko-fi, GitHub, etchwp.com and other external sites. Once you follow a link, that site’s privacy policy applies. The site doesn’t embed content from other sites.
Cookies and browser storage
Browsing the site sets no cookies. Cookies are set only in these cases:
- Comment cookies (comment_author, comment_author_email and comment_author_url, each with a site-specific suffix): set by WordPress only if you leave a comment and tick “Save my name, email, and website in this browser for the next time I comment”. They fill in the form for your next comment and expire after about a year.
- Login cookies: set by WordPress only for me when I log in to the admin area. Visitors never get them.
- Cloudflare security cookies (for example cf_clearance): set only if Cloudflare challenges a request it considers suspicious. They expire within hours.
The audio player also saves your playback position (for 30 days) and your volume and mute setting in your browser’s local storage, so a track can continue where you stopped. This data stays in your browser and is never sent to me. You can delete it by clearing this site’s data in your browser.
Analytics uses no cookies, and nothing on the site stores data in your browser to track you.
Who receives data
I don't sell or rent personal data. The following companies process data on my behalf, under data processing agreements:
- Cloudflare, Inc. (USA): content delivery network and attack protection for every request.
- Fastmail Pty Ltd (Australia): my mailbox, kept on servers in the EU, where your emails arrive and from which I answer form messages.
- Automattic Inc. (USA): Gravatar profile pictures next to comments.
Everything else (the website, the newsletter, the analytics server, form submissions and comments) runs on servers in Germany that I manage myself.
Transfers outside the European Economic Area
Cloudflare and Automattic (Gravatar) may process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework and on the European Commission's standard contractual clauses. Fastmail is an Australian company and keeps replicas, backups and logs of my mailbox in the United States. Australia has no EU adequacy decision; these transfers rely on the European Commission’s standard contractual clauses.”
How long I keep data
- Server logs: 30 days
- Analytics: aggregated, indefinitely
- Newsletter: until you unsubscribe
- Contact and project forms: 12 months after our last exchange, or longer if the law requires. Feedback forms: 12 months after the report is closed
- Comments: as long as the article is online, or until you ask for removal
Your rights
Under the GDPR you can ask me to:
- tell you what data I hold about you and give you a copy;
- correct it;
- delete it;
- restrict how I use it;
- hand it over in a machine-readable format;
- stop using it where I rely on legitimate interest;
- and you can withdraw consent at any time, which does not affect what was done before.
Write to hello@etchdeveloper.com and I'll answer within one month. You can also complain to a supervisory authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.
Security
The site is served over HTTPS only, the server and WordPress are kept up to date, backups are encrypted, and access to the admin area, the analytics server and form submissions is limited to me.
Changes to this policy
When something changes, for example a new tool or a new form, I update this page and the date at the top. For larger changes to the newsletter I'll also say so in the next email.
Contact
Tom Chmiel, hello@etchdeveloper.com