What this site records about visitors, and what it never touches
Last updated · Version 1.0
This page is run and measured by me, Kamen Kolev, from a static host. I wrote the statistics module myself rather than embedding a third-party script, because I would not put an uncertified data flow on a site whose subject is data protection. It collects the minimum that tells me whether the site is being read, and it is designed so that the records it keeps cannot be tied back to a named person without information I do not store.
The short version: no cookies, no third-party requests, no advertising, no selling or sharing of data, and no IP address is ever written to the database. There is no consent banner because nothing here requires consent under the ePrivacy rules — the only storage is a theme preference and a session identifier that disappears when you close the tab.
What is recorded
- The date and time of each visit, to the millisecond, in UTC.
- Which page and which section you reached, how far you scrolled, and which buttons and links you activated — including outbound clicks to LinkedIn.
- Approximate location: country, region and city, resolved by my hosting provider from the network route your request took. Never a street, never a device.
- The autonomous system number and name of your network — in practice, the ISP or the company that owns the connection you are on.
- Browser hints you hand to every website anyway: user-agent string, preferred language, time zone, screen size, and the TLS version and HTTP protocol of the connection.
- A random session identifier, held in
sessionStorage, discarded when the tab closes. - A visitor identifier: the first 16 characters of a SHA-256 hash of
secret salt + date + your IP address. It is recalculated every day, so it cannot follow you across days, and it cannot be reversed into an address.
What is never recorded
- Your IP address. It is used as one input to the daily hash above and is not stored in any form — not full, not truncated, not in a log file.
- Anything you type. The contact form's fields are excluded from the click handler,
no
inputorkeypressevent is ever observed, and the only thing kept about the form is one of three words:sent,failedormail. Your message reaches me through your own mail client or your chosen form service, never through the statistics database. - Queries you type into the on-page search palette, and any query string in a URL that reaches me.
- Cookies (none are set, first-party or third-party), cross-site or cross-device identifiers, and any form of fingerprinting beyond the ordinary request headers listed opposite.
- Anything about you from any other source. There is no enrichment, no matching, no profile.
The exact fields, one by one
| Column | Source | Purpose | Identifier class |
|---|---|---|---|
ts | server clock | time series, retention cut-off | not personal |
sid | random, browser | groups one visit into a session | pseudonymous, ephemeral |
vid | salted daily hash of IP | counts returning visitors | pseudonymous, rotates in 24 h |
event, target, value | page interaction | what is read and what is clicked | not personal |
path, referrer | browser | which page, which link brought you | referrer kept as origin only |
country, region, city, lat, lon, eu | edge network | where the audience is; whether EU data rules apply | coarse geo |
asn, as_org | edge network | network-level context, e.g. a corporate VPN | organisation of the connection |
ua, lang, tz, screen, dpr | browser | which devices and languages the audience reads in | device hints |
tls, proto | connection | responsive and security configuration decisions | device hints |
day, colo, ip_policy | derived at ingest | daily grouping, which edge site served the request, and how the identifier was derived | not personal |
Lawful basis
Article 6(1)(f) GDPR — legitimate interest: measuring whether a professional portfolio performs, which parts of it are read, and whether it produces contact. A balancing test was carried out before collection started and is summarised here: the processing is small in scale, invisible in effect on you, contains no special-category data, cannot identify a person without data I deliberately do not hold, and is deleted automatically after twelve months. The alternative — a hosted analytics provider — would have meant transferring the same data to a third party and relying on their privacy claims instead on mine. I preferred to keep the data flow inside one system I am accountable for.
Retention, deletion and the record
Every event is deleted automatically once it is more than twelve months old. The deletion runs inside the collector itself, once a day, so it does not depend on anyone remembering. Individual sessions or visitor identifiers can be erased on request immediately, and the aggregate figures are recomputed from what remains.
Your rights
Access, rectification, erasure, restriction and objection all apply, and you do not need to know a reference to use them: write to kamen@kamenonline.com with roughly when you visited and from which country, and I will find the matching sessions and confirm the deletion within thirty days. Objecting is also effective without contacting me — see the next paragraph.
Do Not Track and Global Privacy Control
If your browser advertises Do Not Track or a Global Privacy Control signal,
the statistics module is not loaded at all and nothing is sent from your visit. The preference is read
before any network request is made, so honouring it does not itself require a record.
Who can see it, and where it lives
The statistics dashboard is not public. It sits behind Cloudflare Zero Trust Access, which means it requires my authenticated identity and refuses anonymous requests at the network edge before they reach the application. The read API answers nothing without that authentication, including errors. The collector endpoint accepts only same-origin requests, rejects implausible payloads before storing them, and returns no information about why it rejected anything.
Hosting and the only processor of the statistics are the same company, Cloudflare, under its standard data processing addendum; the database is provisioned in the European region. No analytics, advertising, social or consent vendor receives data from this site, because none is embedded.
Every request this page makes goes to one host
The markup, the stylesheet, the script, the photograph, the link-preview card and the two typefaces are all served from this origin. A browser reading this page makes no subresource request to any other company — no font CDN, no analytics endpoint, no tag manager, no social widget, no Google, no Cloudflare-owned script host. The typefaces are Plus Jakarta Sans and JetBrains Mono, both under the SIL Open Font License 1.1, subset to the characters this page uses and version-pinned by filename; their licence texts sit next to the files.
Links out to LinkedIn are ordinary links. Nothing is requested from them until you click, and the click is reported to me as a host name, not to them as a visit.
Controller
Kamen Kolev · Plovdiv, Bulgaria · kamen@kamenonline.com. Sole controller; no joint controllership and no data protection officer appointed, as the processing is not a core activity carried out on a large scale. If this changes, this notice changes first.
Changes
Material changes to what is collected are recorded in the version line at the top of this page. The source of the module is in the same repository as this page, and the tests that keep it honest run on every build.