This policy explains which personal data is processed when you visit koodeau.com, why, and what rights you have. The website has no accounts, no forms, no comments and no advertising. Analytics only runs if you agree to it.
Who is responsible
The controller for this website is Nick Revenko, who runs koodeau.com as an individual. You can reach me at contact@koodeau.com.
The short version
- Hosting and security providers process technical data, such as your IP address, to deliver and protect the site.
- Google Analytics 4 only loads after you click "Accept all". Before that, nothing is sent to Google.
- Icons are loaded from the Iconify API, which receives your IP address and the names of the icons.
- I do not sell personal data, show ads or build advertising profiles.
- You can change your cookie choice at any time with "Cookie settings" in the footer.
1. Visiting the website
When you open a page, your browser sends a request to the servers that deliver the site. This involves your IP address, the date and time, the requested page, the referring page, the response status and technical details your browser sends, such as browser, operating system and language. The RSS feed and the sitemap are served the same way.
Purpose: to show the website, keep it secure and stable, and defend it against abuse and attacks. Legal basis: my legitimate interest in running a secure website (Article 6(1)(f) GDPR).
Who processes it: Vercel Inc. (hosting, USA) and Cloudflare, Inc. (DNS, content delivery network and security, USA). Your request passes through Cloudflare first and then reaches Vercel. Both act on my behalf and keep technical logs for a limited time according to their own policies. I do not use this data to identify visitors and do not combine it with other data.
2. Choices stored in your browser
To remember your decisions the website stores two small items in your browser: your cookie
choice (local storage, koodeau-consent) and, if you switch between light and dark theme by hand, that
choice for the current tab (session storage, color-theme-override). They never
leave your device and are not shared. They are needed for functions you asked for, so they do
not require consent. See the Cookie Policy for details.
3. Analytics with Google Analytics 4 (only with your consent)
If you click "Accept all", or switch on "Analytics" in the settings, I load Google Analytics 4. It tells me which pages are read, how visitors find the site and which devices and browsers they use, so I can improve content and speed. If you do not agree, the Google Analytics script is never loaded and your browser does not contact Google for this purpose.
Data collected: a random identifier stored in a cookie (_ga and _ga_F93CMX6X2H), the pages you view and their titles, how long you stay, clicks on
outbound links, the referring page, approximate location (country and city, derived from your IP
address), browser, device type, screen size and language. Google Analytics 4 does not log or
store IP addresses.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for visitors in the EEA and Switzerland, and Google LLC, USA. I have turned off Google signals and ad personalisation and I do not link Analytics to advertising products. Event data is kept for 2 months.
Legal basis: your consent (Article 6(1)(a) GDPR). Storing and reading Analytics cookies on your device also requires your consent under the ePrivacy rules (Article 11.7a of the Dutch Telecommunications Act). Withdrawing consent: use "Cookie settings" in the footer at any time. Analytics then stops and the Google Analytics cookies are removed. Withdrawal does not affect processing that happened before. You can also install Google's opt-out browser add-on.
4. Third-party content on this website
Icons (Iconify)
Icons are displayed with the Iconify library. Your browser requests the icon data from Iconify's
API servers (api.iconify.design, with api.simplesvg.com and api.unisvg.com as fallbacks). This sends your IP address, browser information and the names of the requested
icons to Iconify. No cookies are set. Purpose: displaying icons. Legal basis: my legitimate
interest in a well-presented website. More about the service: iconify.design.
Fonts
The typefaces Source Sans 3, Source Serif 4 and Source Code Pro are open-source fonts from the Google Fonts library (SIL Open Font License). They are hosted on this website's own servers, so your browser does not connect to Google to load them.
Images and media
Images, project screenshots and preview images are hosted on this website. If a page ever shows an image or media file from another provider, loading it necessarily sends your IP address to that provider.
Links and share buttons
Links to GitHub, X, Facebook, Instagram, LinkedIn, Threads, Medium and about.me are ordinary links. The share buttons under blog posts are also plain links: no plugin from these networks is loaded and nothing is sent to them until you click. After you click, you are on their website and their privacy policy applies.
5. Contact by email
If you email me, I process your email address, your name if you give it, and the content of your message to reply to you. Legal basis: my legitimate interest in answering enquiries, or taking steps you ask for before a contract (Article 6(1)(b) and (f) GDPR). Your email provider processes messages on my behalf. If we work together, I also keep the records I am legally required to keep.
6. Recipients and international transfers
- Vercel Inc. (hosting), privacy policy.
- Cloudflare, Inc. (DNS, CDN, security), privacy policy.
- Google Ireland Limited / Google LLC (analytics, only with consent), privacy policy.
- Iconify (icons), see section 4.
- My email provider (messages you send me).
Several of these providers are based in, or process data in, the United States. Where this applies, transfers rely on the provider's certification under the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
7. How long data is kept
| Data | Kept for |
|---|---|
| Server and CDN logs | A short period, set by Vercel and Cloudflare |
| Google Analytics event data (with consent) | 2 months |
| Analytics cookies (with consent) | Up to 2 years, or until you withdraw consent |
| Your cookie choice (local storage) | Until you clear site data or the choice must be asked again |
| Theme choice (session storage) | Until you close the tab |
| Emails | As long as needed to handle your request, then deleted, unless the law requires me to keep records (for example tax records for 7 years) |
8. Your rights
Under the GDPR you have the right to:
- access the personal data I hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, with effect for the future.
To use these rights, email contact@koodeau.com. I answer within one month. You also have the right to complain to a data protection authority, in the Netherlands the Autoriteit Persoonsgegevens, or the authority in your country of residence.
9. No automated decisions, no sale of data
I do not make decisions based solely on automated processing, I do not profile visitors for advertising, and I do not sell or rent personal data.
10. Children
This website is not aimed at children, and I do not knowingly collect personal data from anyone under 16.
11. Security
The website is served over HTTPS, and the hosting and security providers named above protect their infrastructure. No system is perfectly secure, but I keep the amount of data processed to a minimum.
12. Changes to this policy
If I change how data is handled, for example by adding a new service, I update this page and its date. If a change needs your consent, I ask you again.
13. Contact
Questions about privacy: contact@koodeau.com. See also the Cookie Policy and the Terms of Use.