Privacy Policy

1. Data controller

Paweł Gawliczek operates this site as a personal blog. For privacy requests, use the contact form or reply to any email you receive from me with “Privacy request” in the subject line.

2. Data we collect

• Contact details: Name, email, and anything you include in the message when you use the contact form.
• Newsletter and product-interest subscriptions: Email address, consent and confirmation status, subscription source, and subscription time when you ask for updates. This includes the NeckPilot Android interest list.
• Supporting materials: If you share links or files (e.g., repos, decks), I only access them to respond to your request.
• Usage data: Privacy-friendly analytics (Umami) capture anonymous page views, device type, and referrers when you consent. A cookie stores your preference.
• Anti-spam verification: hCaptcha may process browser data to verify you're not a bot when submitting forms.

3. How we use your data

• Reply to your message and continue the conversation you initiate.
• Send the updates you requested. People on the NeckPilot Android interest list receive only news about a possible Android version, such as testing or a Google Play release.
• Understand which pages and topics resonate so I can prioritise future writing.
• Maintain basic security logs to prevent abuse of the site.

4. Legal bases

Contact form data is processed under Art. 6(1)(b) GDPR (steps prior to potential collaboration). Newsletter and product-interest subscriptions rely on Art. 6(1)(a) GDPR (your consent through the signup form and confirmation email). Analytics relies on your cookie preference. Anti-spam verification and security logs are based on Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).

5. Data retention

Messages submitted through the contact form are stored for up to 12 months unless we begin a longer-term collaboration. Subscription data is kept until you unsubscribe, withdraw consent, or the list no longer serves its stated purpose. Analytics events are aggregated and may be kept indefinitely for trend analysis, but they are not linked to identifiable individuals.

6. Sharing & transfers

I do not sell or rent personal data. The following service providers process data on my behalf:

• Hetzner (Germany): Hosting infrastructure for the website.
• Umami Analytics (self-hosted): Anonymous usage analytics, hosted on EU servers.
• Web3Forms (USA): Contact form submission service. Data transferred under standard contractual clauses.
• hCaptcha (USA): Anti-spam verification service. See hCaptcha's privacy policy.
• MailerLite Limited (Ireland): Stores subscription data and sends confirmation and requested update emails. MailerLite acts as a data processor and stores subscriber data for EEA customers in the EU. See MailerLite's privacy policy.

7. Your rights

You can request access, correction, deletion, or restriction of your data, as well as object to processing or ask for portability. Use the contact form or reply to my email to exercise these rights. You may also contact your local supervisory authority if needed.

8. Security

I secure the site with TLS, server hardening, and restricted administrative access. Any stored messages are kept in secure, access-controlled systems.

9. Updates

I’ll update this page whenever tooling or processes change materially. Significant updates will be highlighted on the site or via email if we’re already in contact.