Last updated: 16 September 2026
This is Grzegorz Kaczmarski’s personal website: a homepage, portfolio and writing archive. Reading public pages does not require an account. The application has no advertising tags or session replay and does not build visitor profiles. Cloudflare Web Analytics is enabled at the edge, with EU visitors excluded; this is described separately below.
Who is responsible and how to contact me
Grzegorz Kaczmarski is responsible for this site and its processing of personal data. For privacy questions or requests concerning your data, email: [email protected]
If you email me, I receive your email address, message and any information you choose to include, so I can respond. This is my personal Outlook.com mailbox, not a ticket system with automatic deletion. Messages may remain there for a long time and there is currently no fixed deletion schedule. That does not override your data-protection rights or justify keeping every message forever. A purpose-based retention practice and the legal basis for correspondence still need to be finalized.
Requests and infrastructure logs
Delivering a page involves processing an IP address, request time, URL/path (including any search query), user-agent and relevant HTTP and security metadata. The server also reads a saved preference cookie, if present, and may use the browser’s language header to select the language of an unprefixed URL. Avoid putting sensitive information in site searches or URLs. The application does not maintain a visitor analytics database or a routine per-request access log. Infrastructure can still process request data and record operational errors or security events; this is not the same as visitor tracking.
Cookies and browser storage
These values serve interface functions, not behavioral advertising or profiling. Cookies are sent with matching requests to this host. Navigation restoration data stays in the browser and is not sent as a cookie. The intro keeps state only in memory: it no longer reads or writes a browser marker. The application does not use localStorage or IndexedDB.
| Name | Type | Purpose | Duration | When created |
|---|---|---|---|---|
language | First-party cookie | Remember EN or PL | Up to 365 days | After activating the language switch in this tab with JavaScript enabled |
appearance | First-party cookie | Remember dark, light or system appearance | Up to 365 days | After changing the appearance selector |
Navigation restoration (SvelteKit) | sessionStorage | Restore scroll positions and framework navigation state; no custom page snapshots are configured | Browser tab session (session restoration may preserve it) | Automatically when the page is hidden or unloaded |
Both cookies are host-only, use Path=/ and SameSite=Lax, and have Max-Age=31536000 seconds from selection (not renewed by ordinary visits). Secure is enabled on HTTPS. The language cookie is HttpOnly; appearance is readable by JavaScript because the appearance control writes it. Cookie flags do not apply to sessionStorage, which is scoped to the origin and tab.
You can change these preferences using the language switch and the appearance selector, or remove them in your browser’s site-data settings. Clearing cookies restores defaults. The intro does not repeat on internal navigation, but starts again after a full reload. A marker left by an older version is no longer used and can be removed by clearing site data. Blocking storage does not prevent reading public pages. System appearance follows your device’s color-scheme setting without sending it to another service.
Infrastructure, recipients and external services
Requests pass through Cloudflare to a self-hosted application on Oracle Cloud in Frankfurt, Germany. This verifies the server’s location, not the location of every provider operation. Cloudflare and Oracle may process request/security data to deliver and protect the site. The operator can access operational data. Outlook.com processes messages sent to the published contact. Private administration uses Cloudflare Access authentication. Fonts and application assets are local, and public status is a sanitized server snapshot. External links lead to services with their own privacy rules.
Cloudflare analytics
Cloudflare Web Analytics is configured for automatic installation outside the EU, with EU exclusion enabled. It measures visits and browser performance rather than advertising profiles. Cloudflare describes this analytics service as cookieless; that is not a general legal exemption from consent requirements. Its beacon can use page/referrer information, browser/device categories and performance timings. The site’s restrictive content-security policy is unchanged and may block the analytics script. Cloudflare also processes server-side traffic/security statistics independently of this browser beacon. Unused Zaraz tag-manager injection is disabled.
Security and traffic protection
The site uses Cloudflare for network delivery and security. Cloudflare may process technical request information and may store security-related cookies such as cf_clearance where required to verify legitimate traffic, prevent abuse or allow access to the protected site. These mechanisms are not used by this site for advertising or behavioural profiling.
Cloudflare, Oracle and Microsoft operate internationally and some processing may take place outside the European Economic Area. Their official documents describe transfer safeguards, but the applicable contracting entities, accepted terms and mechanisms for this site/account have not all been verified. A server in Germany does not establish EU-only processing. No account-specific residency or transfer guarantee is made here.
Purposes and legal bases
Necessary security and operational logging relies on Article 6(1)(f) GDPR: my legitimate interests in preventing abuse, investigating faults and keeping the site reliable and secure. Logging is limited to those purposes, with restricted access and time-based retention. You may object on grounds relating to your particular situation. This basis is not a blanket authorization for browser analytics, advertising or indefinite email storage. Interface storage remembers requested preferences and restores navigation; selecting a preference is not consent to analytics or advertising.
Retention
Server and proxy logs under my control are normally retained for up to 30 days for security, abuse prevention, troubleshooting and service reliability. Relevant records may be retained longer where necessary to investigate a specific security incident or establish, exercise or defend legal claims. Time-based cleanup enforces the ordinary ceiling. This is not a promise about independent provider logs or email: provider retention remains subject to their applicable terms and settings; the personal mailbox practice is described above.
Your GDPR rights
Where the GDPR applies, you may request access to your personal data, correction, erasure or restriction of processing. Depending on the processing and its legal basis, you may also object or request portability. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. These rights have legal conditions and exceptions. You may complain to the President of the Polish Personal Data Protection Office (UODO) if you believe your data is being processed unlawfully.
Further information: UODO · Cloudflare · Oracle · Microsoft
Changes to this notice
This notice should change when the site’s actual processing changes. Adding non-essential tracking or analytics requires a separate privacy and consent review before activation.