Privacy and analytics

Koloszár András, a natural person, is the controller of personal data processed for andras.digital. Contact: koloszar.andras@gmail.com. For provider information, see Legal / Impressum.

Opening this website

Cloudflare delivers and protects the website. This involves receiving your IP address and technical request information. I rely on the legitimate interest in providing a reliable, secure website. This processing is separate from optional audience measurement. There is no website contact form; contact links open your email application. Fonts and images are hosted with the website.

Automatic Cloudflare Web Analytics and network error reporting (NEL) were disabled on 21 September 2026. This does not erase historical provider records or immediately clear policies already cached by visitors' browsers. The analytics retention periods below do not apply to all Cloudflare infrastructure records.

Optional analytics — your choice

If you select “Allow analytics”, I use events to understand which distribution channels lead to interest in my work. The data includes a random temporary browser-tab session ID, page-view and event IDs, an approved source code, a page code, section or button code, a minute-level receipt time, and the consent version and day. It does not include names, email addresses, message contents, full page addresses, full referrer addresses or device fingerprints. The application does not store IP addresses in the analytics database; Cloudflare still handles them to deliver requests.

Shared links may contain a source code such as #source=M01. A code represents a distribution channel, not the recipient. The code is read only after permission. An existing permitted session continues across pages in the same tab. After 30 minutes of inactivity, after 24 hours, or on arrival from a different explicit source code, a new session begins. We do not identify the same person across devices or later visits.

The legal basis for optional analytics is your consent. “Allow analytics” and “Reject analytics” are offered together. Closing the notice, scrolling or continuing to browse does not give permission. Use “Withdraw analytics consent” in the footer, or “Analytics settings” → “Reject analytics”, to stop measurement and request deletion of events linked to the deletion keys still held by this browser tab. Other open tabs using the same browser storage also stop and submit their available keys. This includes earlier sessions in those tabs while their keys remain available. We do not claim to identify all your visits across closed tabs, cleared storage, devices or browsers.

The interface confirms deletion only after the server acknowledges it. If the request fails, analytics remains off and the deletion keys are retained for retry, including on another page or when you return online. Do not clear the browser data before confirmation. A successful response means the linked events have been removed from the active analytics database, not that every provider backup has immediately disappeared. Withdrawal does not make earlier lawful processing unlawful; it does end further consent-based processing, including retention unless another valid basis applies.

Random deletion keys are separate for each session. Only their hashes, session references, expiry and revocation times are stored in a separate security table, to authenticate deletion and prevent late events reappearing. They are not used for audience reports or linking separate visits. Before withdrawal, a security record remains for up to 32 days from the session's start so retained events can still be deleted. After successful deletion, the record remains for up to 48 hours. These limits assume working daily cleanup and exclude recovery backups. A later deletion retry after the record has expired can create a new, short-lived security record, but does not restore events. I retain these limited records to handle withdrawal and meet data-protection obligations.

Events are available for analysis for 30 days and deleted by a daily cleanup, within 31 days when the cleanup is operating correctly. The selected Workers Free plan has a 7-day D1 Time Travel recovery window, during which recovery copies can still contain deleted records. Recovery copies are not used for analysis. The operating policy is to start with an empty analytics database instead of restoring historical events; an unavoidable restore must be followed by a full analytics purge before reporting or collection resumes. No advertising pixels, remarketing, session replay, keystroke capture or cross-site profiles are used.

A service outage or exhausted usage allowance can delay deletion and cleanup. If deletion is not confirmed, the request remains pending for retry.

Storage on your device

If choice storage is unavailable, the choice lasts only for the current page. If deletion-key storage is unavailable, analytics stays off. No analytics consent cookie is set. Infrastructure security measures may behave differently during an attack; these must be recorded separately if introduced.

Contacting me

If you email me, I receive your address, message and any information you choose to include. I use it to respond and, where requested, discuss a potential engagement. For steps you request towards a contract with you personally, the legal basis is GDPR Article 6(1)(b). For business-representative and other professional inquiries, I rely on the legitimate interest in responding to the matter you raised and keeping the necessary context. Your inquiry is not automatically added to marketing lists or joined to your analytics session. Please start with a short description, without confidential client records, passwords or sensitive personal information.

Unsuccessful inquiries are kept for six months after the last substantive exchange, unless an actual legal claim or obligation justifies keeping specific information longer. This is the controller's selected retention period, not a statutory minimum. It applies to correspondence held by the controller, not a promise that provider recovery copies immediately disappear.

The contact mailbox is consumer Gmail, not Google Workspace. Google states that it does not offer a Data Processing Agreement or act as a processor for consumer Gmail. The mailbox is not covered by a Workspace processor agreement.

Google processes information under its own Privacy Policy, which generally identifies Google Ireland Limited as the controller for EEA-based users. Processing may take place outside the EEA; Google's transfer notice explains its use of adequacy decisions, the Data Privacy Framework and standard contractual clauses. Consumer Gmail is therefore governed by Google's consumer terms and privacy policy, not a processor agreement with me.

Who processes the information

The hosting provider and analytics processor is Cloudflare, Inc.; its address and contact details are on the Legal / Impressum page. This account uses Cloudflare's self-service agreement, including its Data Processing Addendum. The DPA distinguishes transfers covered by the Data Privacy Framework from restricted transfers protected by standard contractual clauses, and sets obligations for subprocessors. Information about these safeguards is available through those links or by contacting me.

The optional analytics database uses D1's EU jurisdiction setting, which restricts where that database runs and stores data. Workers can access it from outside the EU; network and support processing can also involve other countries. Cloudflare additionally describes its processing of network data in its Privacy Policy. I do not promise exclusively EU processing or zero infrastructure logs. Audience reports use authenticated account access, not a public analytics dashboard.

Cloudflare distinguishes its roles: it acts as a processor for customer logs and content processed through its services, while acting as a controller for other personal information covered by its Privacy Policy. Its general retention criteria consider the processing purpose and legal obligations; we have not verified one fixed retention period covering every infrastructure record.

Your rights

You can request access, correction, erasure or restriction, object to processing based on legitimate interests, and request portability where it applies. You can withdraw consent at any time. Contact the address above; requests are generally answered within one month, with any lawful extension explained. Because analytics uses temporary identifiers, I may not be able to connect a name or email to a record, and will not collect additional identifying information merely to do so. You may supply an existing session reference if available.

You can lodge a complaint with the Hungarian authority, NAIH, or another competent supervisory authority, and seek a judicial remedy. This website does not make automated decisions producing legal or similarly significant effects about you.