What this site does with your data

This is the information notice required by Article 13 of the GDPR. It is written against what the code actually does rather than against a template, and the last section tells you how to check every claim on this page without taking my word for it.

Last updated: 9 September 2026.

Who is responsible

Marcin Mozolewski
Warsaw, Poland
contact@mozolewski.eu

I am the controller of the personal data described below, within the meaning of Article 4(7) GDPR. There is no data protection officer: this site meets none of the conditions in Article 37(1) that would require one. Write to the address above about anything on this page.

What happens when you open a page

Two things, and both of them are Cloudflare.

Serving the page

mozolewski.eu is hosted on Cloudflare Pages and Cloudflare is the CDN in front of it, so every request reaches Cloudflare's servers before it reaches anything of mine. In doing that, Cloudflare processes your IP address, the request headers your browser sends (user agent, language, referring page), the URL you asked for and the time you asked for it. This is unavoidable for any hosted website: it is how the bytes get to you, and how the site is kept available.

• Purpose: delivering this site, and protecting it from abuse.
• Legal basis: Article 6(1)(f) GDPR — my legitimate interest in running a working, protected website.
• Role: Cloudflare acts as my processor, under its Data Processing Addendum.

Counting the page view

Cloudflare Web Analytics is switched on. Cloudflare's edge injects a small script into every HTML response it serves — including this page — which reports that a page was viewed, along with the referring page, a country derived from your IP address, and page-performance timings. Cloudflare states that it "does not use any client-side state, such as cookies or localStorage, to collect usage metrics" and that it does not "'fingerprint' individuals via their IP address, User Agent string, or any other data for the purpose of displaying analytics".

What reaches me is a count. I cannot see who you are, I cannot follow you between visits, and I cannot follow you to any other website.

• Purpose: knowing whether this site is read at all, and how fast it loads.
• Legal basis: Article 6(1)(f) GDPR — my legitimate interest in knowing whether the work reaches anyone. You may object under Article 21(1); see Your rights.
• Retention: the request logs and the analytics data are held by Cloudflare under its own retention rules. I keep no copy and have no access to raw logs.

Cloudflare, Inc. is in the United States. It is certified under the EU-U.S. Data Privacy Framework, and its Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses as a fallback if that certification ever lapses.

What your browser is asked about, and never tells anyone

This one is on page load, not behind a button, so it belongs here rather than further down. The ~/visitor panel shows your timezone, browser language, screen size and whether your system asks for a dark theme. Those are read on your device the moment the page runs, printed straight back to you, and never transmitted — they are there to make the point that any website can see them without asking. They do not reach me, Cloudflare, or anyone else. Your IP address is a different matter and is not among them: that is the button, and it is the section below.

Two smaller things the edge adds

Both are named here because the last section invites you to read the network tab, and you would otherwise find two requests this page had not mentioned. Both are served from this domain, and neither is a new recipient of anything.

• Email address obfuscation. Cloudflare rewrites the addresses printed on the page and adds a small first-party script, /cdn-cgi/scripts/…/email-decode.min.js, which puts them back in a real browser. It exists so that address-harvesting bots collect a scramble instead of a working mailbox. It reads nothing about you.
• Speculation rules (Cloudflare Speed Brain). A small first-party file, /cdn-cgi/speculation, tells your browser which links it may fetch ahead of a click. Its rule matches /* relative to this document, so the only thing it can pull early is another page of this site, from this site. Open the file and read it — it is four lines.

What does not happen

• No storage on your device. No cookie, no localStorage, no sessionStorage, no IndexedDB. Storing information on your terminal equipment, or reading information already stored there, is what Article 399 of the Polish Prawo komunikacji elektronicznej — and Article 5(3) of the ePrivacy Directive behind it — requires consent for. This site does neither, which is why you are not asked to click through a banner.
• No third-party analytics or advertising. No Google Analytics, no Google Tag Manager, no Google Fonts, no advertising network, no retargeting pixel, no social media embed, no visitor counter. The typeface is served from this domain, and the certification badges in ~/certs are baked into the page when it is built, so your browser never contacts Credly.
• No collection of your identity. No accounts, no login, no contact form, no comments, no newsletter. There is nothing here that asks for your name.
• No profiling and no automated decision-making within the meaning of Article 22 GDPR.
• Nothing is sold, and nothing is passed to anyone for their own purposes.

Where Google does come in

Saying "no Google Analytics" and stopping there would be a half-truth, so here is the whole one. This domain is registered in Google Search Console. That is not a tag, a script or a cookie — it is a report, and it runs in the opposite direction to analytics.

• Ownership of the domain is proved by a DNS TXT record, not by anything on this page. There is no verification meta tag in the HTML and never has been.
• What Search Console shows me is which search terms led people here, how many saw the link, how many clicked it and roughly where the page ranked. All of it is measured by Google on Google's own search results page, where Google is the controller and its own privacy policy applies — before anyone reaches this site at all.
• What arrives on my side is aggregated: counts, search terms and average positions. Never an IP address, never a name, never anything that picks out one person.
• Nothing about it touches your device, and no request from these pages goes to any Google host — which you can check in the network tab, and which the Content-Security-Policy would enforce even if the code tried.

Put plainly: if you arrived here from a Google search, Google already knew that before this page loaded. Opening it adds nothing to what Google has, and sends Google nothing new.

What happens only if you ask for it

Parts of this site can reach outside this domain. Each of them waits for you, and says so before you act.

The lookup in ~/visitor

That section shows a run the lookup button and, above it, a note naming everyone the press will contact. If you press it:

• your IP address is sent to ipapi.co, operated by Kloudend, Inc., Henderson, Nevada, USA, which answers with an approximate city and a network name;
• if ipapi.co does not answer, the same request goes to ipwho.is instead;
• the map is then drawn from tile.openstreetmap.org, run by the OpenStreetMap Foundation in the United Kingdom, which receives your IP address as the tiles are fetched.

Legal basis: Article 6(1)(a) GDPR — your consent, given by pressing a button that names all three recipients before you press it. Nothing about the lookup is stored anywhere: reload the page and it is gone. To withdraw your consent, do not press it again — there is nothing for me to delete, because nothing reached me.

Transfers: Kloudend states that transfers outside the European Economic Area are governed by the Standard Contractual Clauses under its data processing agreement. The OpenStreetMap Foundation is in the United Kingdom, which the European Commission has found to provide an adequate level of protection. ipwho.is publishes no company details, which is a real limit on how much I can tell you about it — it is a fallback only, and it is named to you before the press precisely so the choice stays yours.

systemctl in ~/shell

Typing systemctl at the prompt checks whether two hosts answer. One is this site itself. The other is github.com, which receives your IP address exactly as any request to GitHub would. The command's own help line names it before you run it. Legal basis: Article 6(1)(a) GDPR, your consent, given by typing it.

If you email me

contact@mozolewski.eu is a plain mailto: link. Pressing it opens your own mail program; nothing is submitted through this site. If you write to me, I process what you put in the message and the address you sent it from, for as long as the exchange and any follow-up need it.

• Purpose: answering you.
• Legal basis: Article 6(1)(f) GDPR — the mutual interest in a reply; or Article 6(1)(b) where the exchange is a step towards a contract.
• Recipient: my mailbox provider, Apple Distribution International Ltd. (iCloud Mail on a custom domain), Ireland.
• Obligation: none. Writing to me is voluntary, and the only consequence of not writing is that I cannot reply.

Where the data goes

Your rights

Under the GDPR you may ask me to give you access to your data (Art. 15), correct it (Art. 16), erase it (Art. 17), restrict its processing (Art. 18) or hand it over in a portable form (Art. 20). You may object at any time to anything done on the basis of legitimate interest, the page counter included (Art. 21). Where the basis is your consent — the lookup, the shell command — you may withdraw it at any time, and the withdrawal does not affect what was lawful before it.

Write to contact@mozolewski.eu to exercise any of them.

One caveat, and it is an honest one rather than an evasion. Because this site stores nothing, sets no identifier and keeps no record that could be tied to you, I usually cannot tell which data is yours. Article 11 GDPR covers exactly that situation: I am not obliged to collect extra information about you purely in order to find you, and without something that lets your data be located I may not be able to act on a request for access, erasure or portability. Your right to object does not depend on any of that, and it costs nothing to exercise.

You also have the right to complain to a supervisory authority (Art. 77). Mine is the Polish one:

President of the Personal Data Protection Office
Prezes Urzędu Ochrony Danych Osobowych
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl

Verify any of this yourself

None of the above needs to be taken on trust.

• The site is open source: github.com/marcjanek/marcjanek. The page is one HTML document and one script file, and this notice is a file in the same repository.
• public/_headers carries a Content-Security-Policy that lists every host your browser is permitted to contact. A host that is not on that list cannot be reached from this page whatever the code says, because the browser refuses it. Read it for yourself: curl -sI https://mozolewski.eu/ | grep -i content-security-policy
• Open your browser's developer tools, reload, and read the network tab. A fresh load of this page makes six requests, and every one of them is accounted for above: the document itself, /cdn-cgi/speculation, the email-decode script, the typeface, /cdn-cgi/rum (the page count) and static.cloudflareinsights.com (the script that sends it). Five from this domain, one from Cloudflare, none from anywhere else. If you see a seventh, this page is wrong and I would like to know.
• Then open the storage tab: it is empty. No cookie, no localStorage, no sessionStorage — on this page and on every other one.

Changes

This notice changes when the site does — a new outside host is not allowed to arrive without it. There is no version history here because the repository is the version history: the date at the top is the date this file last changed, and git log public/privacy.html shows exactly what changed and when.