Privacy Policy
Last updated: 2026-08-01
TL;DR
This site sets no cookies. There is no analytics, no tracking pixel, no fingerprinting. If you don't use the contact form, I learn nothing about you beyond what my hosting provider writes to its access log. If you do use it, I get your email address and your message, and nothing else.
CONTROLLER // art. 13(1)(a)
This site is run by Jakub Kuźnicki, based in Warsaw, Poland. For anything about this policy or your data, email kubon.kuznicki@gmail.com.
No Data Protection Officer is appointed. Nothing this site does requires one under GDPR art. 37 — no public-sector processing, no large-scale systematic monitoring, no large-scale processing of special-category data.
WHAT_IS_COLLECTED // art. 13(1)(c)
If you never touch the contact form, nothing personal is collected here beyond what any web server logs by default: your IP address, the page requested, a timestamp and your user agent, written to Vercel Inc.'s access logs.
If you fill in the contact form, I additionally get whatever you type into it: an email address (so I can reply) and a message. That's the whole form — there is no name field, no phone field, no account. Formspree, which handles the submission, also automatically records the sender's IP address, timestamp and user agent for spam prevention.
WHY // art. 13(1)(c)
- To reply to your message.
- To detect and filter spam or abusive submissions.
- To keep the site's infrastructure secure and operational (standard hosting logs).
LEGAL_BASIS // art. 13(1)(c)
Art. 6(1)(f) — legitimate interest in replying to correspondence sent to me, preventing spam, and keeping the site secure.
Art. 6(1)(b) — where your message concerns a possible collaboration or engagement, processing is necessary to take steps you requested before entering into a contract.
Note what's not on that list: consent. Nobody ticks a box to send this form, and none is needed — see YOUR_RIGHTS below for what that means for you in practice.
WHO_ELSE_SEES_IT // art. 13(1)(e)
- Formspree Inc. (USA) — receives and forwards contact form submissions.
- Google LLC / Gmail (USA) — my inbox is a gmail.com address, so Formspree delivers your message there.
- Vercel Inc. (USA) — hosts this site and its access logs.
No data broker, ad network, or analytics vendor ever sees anything, because none is used on this site.
TRANSFERS_OUTSIDE_EEA // art. 13(1)(f)
All three processors above are US companies, so data described in this policy leaves the EEA. GDPR art. 46 requires an appropriate safeguard for that — typically Standard Contractual Clauses or certification under the EU-US Data Privacy Framework.
Hosting: Vercel's Data Processing Addendum incorporates the Standard Contractual Clauses approved by the European Commission in decision 2021/914 (Module Two, controller to processor).
Contact form: Formspree does not publish a Data Processing Addendum, and its privacy policy states that data is transferred to the US without naming the safeguard it relies on. If that matters to you, use the email address in the CONTROLLER section instead of the form.
HOW_LONG // art. 13(2)(a)
Contact form messages: kept up to 12 months, then deleted. Once a thread is answered and done, I remove the submission from the Formspree dashboard rather than waiting out the full 12 months.
Server access logs (Vercel): kept for whatever period Vercel's own retention policy sets. I neither read nor export them.
YOUR_RIGHTS // art. 13(2)(b),(d)
Under GDPR you can ask me to: access what I hold about you (art. 15), correct it (art. 16), delete it (art. 17), restrict processing (art. 18), or hand you a portable copy (art. 20).
Processing here rests on legitimate interest, not consent, so the mechanism that applies is objection under art. 21 — not "withdraw consent," because none was given. If you object, I stop processing unless I can show compelling legitimate grounds that override your rights, which for a routine email thread I usually won't have.
Email kubon.kuznicki@gmail.com for any of the above. You can also complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa — uodo.gov.pl.
VOLUNTARY // art. 13(2)(e)
Using the contact form is entirely optional. Nothing on this site requires it — no account, no newsletter, no content gated behind it. If you don't submit it, none of the form-related data above ever exists.
NO_AUTOMATED_DECISIONS // art. 13(2)(f)
No profiling and no automated decision-making within the meaning of GDPR art. 22 happens with anything you send me. Every message is read by a human — me — and answered, or not, by me.
THIRD_PARTY_REQUESTS // art. 13(1)(e)
Loading any page on this site makes no requests to any third party at all. Fonts, images, styles and scripts are all served from this domain — nothing is fetched from Google Fonts or any other CDN.
The recent-commit list on the homepage is fetched from the GitHub API when the site is built, not when you visit it. Your browser never contacts GitHub, so your IP address never reaches it.
The one exception is submitting the contact form, which sends your email address and message to Formspree Inc. as described above. Beyond that: no analytics beacon, no ad pixel, no third-party script runs on this site.
EXTERNAL_LINKS
This site links out to GitHub, LinkedIn, and live demos of some of my projects. Once you click through, you're on someone else's site, governed by their privacy policy, not this one. I have no control over what they collect.
CHANGES
I may update this policy as the site or its processors change — most likely as one of the checklist items at the top of this file gets resolved. The date at the top of this page is the last time it changed; check back if you want to be sure.