Privacy

##Who is responsible

Mathias Maagerø Lekven is the controller for the personal data described here. You can reach me at [email protected].

The services run on a machine in my home in Norway. Nobody but me has access to it.

##Server logs

Every request that reaches my server is written to an access log: the time, the address you asked for, the response, your IP address and your browser's user agent (which browser and operating system you use).

On the other sites under maagero.dev (not maagero.dev itself), an extra line records a visitor ID instead of the IP address. The ID is a one-way hash of the date, the site, your IP address and your user agent. It lets me count one browser once a day per site without storing anything in your browser. It changes every day and differs from site to site, so it cannot be used to follow you over time or between sites. This line records the path, but not anything after the question mark in the address.

The purpose is to keep the services running and secure, find faults and see how many people visit. The legal basis is legitimate interest (GDPR Article 6(1)(f)).

The logs rotate every week and the last four weeks are kept, so a line is deleted after five weeks at most.

##Cloudflare

All traffic to maagero.dev goes through Cloudflare, which provides DNS, encryption (HTTPS) and the connection into my server. Cloudflare therefore processes your IP address and request to deliver the page and protect it against attacks. Cloudflare is my data processor under Cloudflare's data processing addendum.

Visits are counted with Cloudflare Web Analytics. Cloudflare adds a small script to the pages that reports page views and how fast the page loaded. It sets no cookies, stores nothing in your browser and builds no profile of you across websites. I only see totals: page views, which sites visitors came from, country, browser and device type. The legal basis is legitimate interest in knowing how the pages are used.

Cloudflare is a US company. The transfer to the US relies on the EU–US Data Privacy Framework, under which Cloudflare is certified, and the EU standard contractual clauses.

##Sign-in accounts

Some sites under maagero.dev are only for people I have given access. Sign-in happens at auth.maagero.dev, which runs Zitadel on the same machine in my home. Nobody can create an account themselves: I create it when you have asked for access or agreed to it.

For an account, this is stored:

• your email address, which is also your username
• your name
• your password as a one-way hash, never in plain text, or your passkey
• which sites you have access to
• a history of sign-ins and changes to the account, with time, IP address and browser

On a site behind sign-in, each line in the server log also records your email address, so I can see who opened what.

When you sign in, cookies are set that keep you signed in. They are strictly necessary for signing in and used for nothing else.

The sign-in service sends no email and has no way out to send any. A forgotten password is replaced by me giving you a new, temporary one.

The purpose is to give you the access you asked for and keep the sites secure. The legal basis is the agreement to give you access (Article 6(1)(b)) and legitimate interest in security (Article 6(1)(f)).

The account is kept until you ask me to delete it, or until you no longer need access. Taking away your access to one site does not delete the account; tell me and I will delete it. Zitadel keeps an internal history of changes to each account, and it stays in the database after the account is deleted. It is used only for security and troubleshooting.

##What does not happen

No advertising, no tracking cookies, no selling or sharing of data. Beyond Cloudflare, as described above, nobody else gets access to it.

##Your rights

You can ask for access to the data about you, have it corrected or deleted, ask for processing to be restricted, and object to processing based on legitimate interest. You can also ask for a copy of your account data. Email [email protected] and I will answer within a month.

Outside the sites behind sign-in, the server logs contain no name or email address. To find your lines there, I therefore need your IP address and roughly when you visited.

If you believe I process your data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet): www.datatilsynet.no