Privacy policy

Last updated: 25 October 2026

Who is responsible

This is the personal blog of Victor Zaragoza Lluch, an individual based in Dublin, Ireland. I am the data controller for the data described on this page. For any privacy question or request, write to [email protected].

Visit statistics (no cookies)

To know which articles are read, the blog uses its own analytics. A small script sends a few facts about each visit to api.quantumapi.eu, a server I run in the European Union, behind Cloudflare. It sets no cookies and stores nothing on your device.

What is recorded:

  • the page address, and the site you came from (its domain only);
  • campaign tags in the link, if any (utm_*);
  • your browser language and a screen-size class;
  • your country, worked out by Cloudflare from your IP address. Nothing finer than the country;
  • browser, operating system and device type (families only, such as "Firefox", "Android", "mobile");
  • how long you actively read the page and how far you scrolled;
  • the domain of external links you click;
  • whether the newsletter form was shown or sent (never what you typed), and clicks on series links and RSS.

Your IP address and browser user agent are used only in memory, to derive the country and device type, to filter out bots, and to compute a daily visitor code. That code is a keyed hash of the site, your IP address and your user agent, made with a random value (a salt) that changes every day and is deleted after 48 hours. After that, nobody, including me, can link the code back to an IP address. The IP address and the user agent are not stored.

The data is not used for advertising or profiling, not combined with the newsletter or the comments, and not shared with anyone. Individual events are kept for 13 months; daily totals, which hold no visitor code, are kept without a time limit.

Legal basis: my legitimate interest in measuring the audience of my own blog (GDPR art. 6(1)(f)). To opt out, turn on Global Privacy Control in your browser (the script then sends nothing) or block api.quantumapi.eu. Because nothing links an event to a person after 48 hours, I cannot find "your" visits to give you access to them or erase them.

Google Analytics (transition period)

For a short transition period (until about mid-November 2026) the blog can also use Google Analytics 4, provided by Google Ireland Limited, to compare it with the analytics above. It is loaded only if you click "Accept Google Analytics" in the banner. If you accept, Google sets the cookies _ga and _ga_HHNQLF1QQ4 (lifetime up to 2 years) to tell visitors apart, and processes your IP address, device data and the pages you visit here. Google may transfer this data outside the EU under the EU-US Data Privacy Framework or Standard Contractual Clauses.

Legal basis: your consent (GDPR art. 6(1)(a)). You can withdraw it at any time with "Cookie settings" in the footer; the blog then deletes the _ga cookies it can reach and stops loading Google Analytics. Google Analytics will be removed from the blog at the end of the transition, and this page updated.

Newsletter

If you subscribe, the form sends your email address to Buttondown (Buttondown, Inc., United States), which stores it with the details of your subscription and sends the new-article emails for me. I use your address only for those emails. Legal basis: your consent (GDPR art. 6(1)(a)). Every email has an unsubscribe link, and you can also ask me to delete your address. Buttondown processes the data on my behalf under its data processing terms, which cover the transfer to the United States. The visit statistics only record that the form was shown or sent, never your address.

Comments

To comment you sign in with GitHub. The comment service, which I run on Microsoft Azure, stores your GitHub username, your avatar URL, the comment text, the article and the date. Comments are reviewed before they are published, and a published comment shows your username and avatar. A sign-in token is kept in your browser's local storage (blog_session) until it expires. Legal basis: your choice to post (GDPR art. 6(1)(a)); ask me and I will delete your comments. GitHub's own privacy policy applies to the sign-in.

Hosting

The pages are served by Vercel Inc. Like any web host, Vercel processes your IP address and request details to deliver the pages and protect the service. Fonts are served from this site; there are no other third-party embeds.

What is stored on your device

  • theme (local storage): your light or dark mode choice.
  • ga-consent (local storage): whether you accepted or declined Google Analytics.
  • blog_session (local storage): only if you sign in to comment.
  • _ga, _ga_HHNQLF1QQ4 (cookies): only if you accept Google Analytics.

The first three are needed for features you ask for and need no consent.

The previous visit counter

Until 25 October 2026 the blog sent each visit to an earlier counter of mine on Microsoft Azure, which recorded the page, the referrer, the full browser user agent and a short hash of the IP address and date. It has been switched off and collects nothing new. The records it already holds remain in Azure storage until they are deleted; this page will say when.

Your rights

You can ask for access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interest, and you can withdraw consent at any time. Write to [email protected]; I answer within one month. You can also complain to the Irish Data Protection Commission (dataprotection.ie) or to the authority of the country where you live.

Changes

When the processing changes I will update this page and the date at the top.