Privacy Policy — Joe Kuster

What we collect and why

This site collects only what it needs to operate. No tracking pixels, no ad networks, no third-party analytics.

Contact form

If you submit the contact form, we collect your name, email address, and message. This data is:

Forwarded to a dedicated contact inbox (the in-universe persona "Sophie") via Microsoft Graph API. The mailbox address itself isn't published — submissions flow through this site's contact form, not direct email.
Recorded in an append-only local database for replay/audit purposes.
Auto-purged after 90 days.

We use Cloudflare Turnstile for bot detection on the contact form. Turnstile is privacy-preserving and does not place tracking cookies or fingerprint you across sites. See Cloudflare's privacy policy.

If you subscribe to the newsletter, your email address is stored in our self-hosted Listmonk instance running on the same server as this site (no third-party data processor). You can unsubscribe at any time via the link in any email. We never share your email with third parties for marketing.

Theme preference

Your light/dark theme preference is stored in localStorage in your browser. It never leaves your device. See the Cookies & Local Storage page for the full picture.

Server logs

Traffic is routed through Cloudflare Tunnel. Cloudflare may log request metadata (IP address, request path, timestamp) for security and performance purposes per their privacy policy. We do not run additional access logging on the origin server.

What we don't do

We don't use Google Analytics, Meta Pixel, or any ad-network trackers.
We don't sell or share personal data with data brokers.
We don't use third-party comment systems that embed tracking.
We don't serve ads.

Data retention

Contact form submissions are purged automatically after 90 days. Newsletter subscribers remain in our self-hosted Listmonk instance until they unsubscribe. No other personal data is retained beyond a single session.

Your rights (GDPR / UK GDPR)

If you're in the EU or UK, you have the right to access, correct, delete, or port any personal data we hold about you. To exercise these rights, use the contact form and tell us which right you're invoking; the request will be routed to the inbox owner within one business day.

You also have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK or your national DPA in the EU).

Changes to this policy

If we make material changes, we'll update the effective date above. We don't send policy-change emails.

Contact

Questions? Use the contact form.