Privacy

Who is responsible

douklar.app is run by Nijat Hummatović (Hummatovic), an individual based in Italy, who makes Douklar. Under the EU General Data Protection Regulation (GDPR) and the Italian Codice Privacy (d.lgs. 196/2003, as amended by d.lgs. 101/2018), he is the data controller for the personal data this site handles.

The site is a non-commercial publication; its status is set out in the legal notice.

The contact for every privacy question and request is douklar@hummatovic.com. As an individual, he publishes no postal address here. No Data Protection Officer is appointed: the GDPR (Article 37) does not require one for processing of this kind and size. The supervisory authority is the Garante per la protezione dei dati personali.

The short version

• No advertising, no profiling, no newsletter, no accounts, no selling or sharing of personal information.
• Audience measurement runs only if you allow it. It is Cloudflare Web Analytics, which uses no cookies and stores nothing in your browser.
• The site's own code sets no cookies. Four small values in your browser remember the choices you make here; they are not sent anywhere.
• The one form, request a platform, sends your message to our inbox by email. It is kept to answer you.

Your right to object

Where we rely on legitimate interest (the request form, spam protection, serving the site, technical logs), you can object at any time, on grounds relating to your situation, by writing to douklar@hummatovic.com (Article 21 GDPR). Audience measurement runs on your consent instead: withdraw it with Privacy choices.

What each part of the site does with data

Audience measurement

What: if you choose Allow, your browser loads Cloudflare Web Analytics. For each page you view it reports the page address (without query strings), the page you came from, load and responsiveness timings (Core Web Vitals), and, derived by Cloudflare from the request, your country, browser, operating system and device type. We see these as counts and charts in Cloudflare's dashboard, not as a record of you.

How it is built: Cloudflare's script sets no cookies, uses no localStorage, sessionStorage or IndexedDB, and does not fingerprint visitors. Cloudflare receives your IP address with each report and, by its own description, drops it at the nearest data centre without storing it.

Legal basis: your consent (Article 6(1)(a) GDPR; Article 122 Codice Privacy, because the script reads information from your device). Until you choose Allow, the script is not loaded at all.

Your choice: Allow and Decline are offered side by side and look the same. The site works the same either way. You can change your choice at any time with Privacy choices at the bottom of every page or the button at the top of this page; a change takes effect at once. Your choice is remembered for 6 months, then you are asked again. If your browser sends Global Privacy Control or Do Not Track, measurement stays off and you are not asked; you can still turn it on yourself with Privacy choices.

Retention: Cloudflare keeps the detailed reports for 7 days and a sample of about 10% of them for up to 6 months, for the charts.

The request form

What: the request page sends your name, email address, the platform you choose and your message.

Purpose: to read your request and answer you.

Legal basis: legitimate interest (Article 6(1)(f) GDPR): you ask, and we answer.

Retention: the email stays in our inbox for up to 12 months after the conversation ends, then it is deleted; sooner if you ask.

Recipients: a Cloudflare Worker receives the form and sends it as one email through Amazon Web Services (Amazon SES) in Frankfurt (eu-central-1), to our own address only. Open and click tracking are off. The form shows no data back and keeps none in your browser.

If you write to us directly instead, the same purpose, legal basis and retention apply to your email.

Spam and abuse protection on the form

What: before the form sends, Cloudflare Turnstile checks that a person is sending. It loads from Cloudflare only on the request page and processes browser and interaction signals to tell people from bots; Cloudflare's privacy policy and its Turnstile terms apply to that check. The form also carries a hidden field that only bots fill in, and refuses a message sent faster than a person could fill it in (2 seconds); neither keeps any data. Your IP address is used as a short-lived counter to limit how many requests one address can send per minute.

Legal basis: legitimate interest (Article 6(1)(f) GDPR): keeping the form usable and the inbox free of spam.

Retention: the rate-limit counters live for about a minute inside Cloudflare's network. Nothing from these checks is stored by us.

Serving the site

What: Cloudflare hosts and delivers douklar.app. Like any web host, it processes your IP address, the page you ask for, your browser's user agent and similar connection data to deliver pages and to block attacks; its firewall rules here refuse web-archive crawlers and requests to the form service that do not come from this site.

Cookies: the site's own code sets none. If Cloudflare ever shows a security check before a page, passing it sets the strictly necessary cf_clearance cookie for a limited time; it is not used to follow you across sites.

Legal basis: legitimate interest (Article 6(1)(f) GDPR): delivering the site and keeping it running.

Retention: we keep no record of ordinary page visits. Cloudflare's own retention applies to its network data.

Technical logs of the form service

What: the form's Cloudflare Worker keeps technical logs to find delivery failures and investigate abuse: the time, the address requested, the approximate location Cloudflare derives from your IP address, and error messages. The text of your message is not written to these logs.

Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Retention: 3 days, then Cloudflare deletes them.

Videos

Tutorial videos are hosted on YouTube. A video shows a still image stored on this site; nothing is requested from YouTube until you press play. Pressing play loads YouTube's privacy-enhanced player (youtube-nocookie.com), and from then on Google's privacy policy applies to that video, including any cookies or storage it uses.

What your browser keeps

These values are written only when you use the matching feature, stay on your device, and are not sent to us or anyone else. They remember your own choices, so they need no consent (Article 122 Codice Privacy; Garante cookie guidelines, 10 June 2021). Clearing this site's data removes them.

• douklar-theme (localStorage): the light or dark theme you picked, until you clear it.
• douklar-bar-<version> (localStorage): that you closed a release notice, until you clear it.
• douklar-opened (sessionStorage): that the logo opening already played, until the tab closes.
• douklar-consent-1 (localStorage): your audience-measurement choice and its date, for 6 months; then you are asked again.

Who else handles the data

• Cloudflare, Inc.: hosting and delivery, firewall, Turnstile, the form's Worker and its logs, and Web Analytics if you allow it. It processes connection data in data centres worldwide, including the United States. See Cloudflare's privacy policy and data processing addendum.
• Amazon Web Services (Amazon SES), Frankfurt region: sends the form's email to our inbox. AWS processes sending metadata for operating and billing the service. See AWS's GDPR center.
• Our email provider: mail to douklar@hummatovic.com is delivered to a mailbox kept by an email provider, where the retention above applies. Write to us to learn which one.
• Google (YouTube): only after you press play on a video.

Where these companies act on our instructions (sending our email, running our code, measuring with our token), their data processing terms apply. Where they run their own network independently (security, abuse prevention, their own logs), their own privacy policies apply.

Transfers outside the EU

Cloudflare's network may process data outside the European Economic Area, including in the United States, and AWS may access data from outside the EU for support. These transfers rely on the EU-U.S. Data Privacy Framework, under which both companies are certified (see the Data Privacy Framework list), and on the EU Standard Contractual Clauses in each company's data processing terms, which also cover other countries. Write to us for a copy of these safeguards.

Your rights in the EU and the UK

Under the GDPR (and the UK GDPR) you can ask:

• Access (Article 15): whether we hold data about you, and a copy.
• Correction (Article 16): to fix data that is wrong.
• Erasure (Article 17): to delete your data.
• Restriction (Article 18): to limit its use while a concern is checked.
• Objection (Article 21): to stop processing based on legitimate interest. We stop unless there are compelling legitimate grounds that override your interests, or the data is needed for a legal claim.
• Withdrawal of consent (Article 7(3)): for audience measurement, with Privacy choices, as easily as you gave it. Withdrawal does not affect measurement that happened before.

Portability (Article 20) covers data you gave us by consent or contract; ask, and we send you what we hold about you in a common format.

You can also complain to the Garante per la protezione dei dati personali or to the data protection authority where you live or work (in the UK, the Information Commissioner's Office).

Your rights in the United States

We do not sell or share personal information, as the California Consumer Privacy Act (CCPA, as amended by the CPRA) and similar state laws define those words, and we do not use it for targeted advertising or profiling. We collect no sensitive personal information.

In the last 12 months this site has collected these categories, for the purposes above: identifiers (name and email address you send; IP address, used briefly by Cloudflare), internet activity (pages viewed, referrer and device type, only with your consent), approximate location (country, derived from the IP address), and the content of your messages. They come from you and your browser.

Wherever you live, you can ask to know what we hold, to delete it and to correct it, and you can use an authorized agent to ask for you. We do not treat you differently for using these rights.

Tracking across sites: no one collects information about your activity on this site over time and across other sites, except Google if you play a YouTube video (see Videos).

Appeals: if we decline a request, reply to our answer to appeal; we answer the appeal within 60 days and say why. If the appeal is declined, you can contact your state attorney general.

Global Privacy Control and Do Not Track: this site reads both. With either signal on, audience measurement stays off unless you turn it on yourself (California Online Privacy Protection Act disclosure).

How to make a request

Write to douklar@hummatovic.com, ideally from the address you used here, so we can confirm the request is yours; we may ask you to confirm from that address before sharing or deleting anything. Requests are free. We answer within one month (GDPR), extended by up to two months for complex requests, with a note within the first month; for US state-law requests, within 45 days.

Giving us data is voluntary. Without it we cannot answer a request; the rest of the site works the same. There is no automated decision-making or profiling within the meaning of Article 22 GDPR.

Children

douklar.app is a site about a tool for cloud engineers and is not directed at children. We do not knowingly collect data from anyone under 16 (under 13 in the United States, COPPA). If you believe a child has sent us data, write to us and we delete it.

Changes to this policy

The date at the top shows the version in force. When what this site collects changes, this page changes first; when audience measurement changes, everyone is asked again.

Contact

Questions about this page: douklar@hummatovic.com.