What this site knows
about you.
Not much.
No account, no newsletter, no advertising, no cookie banner — because there is nothing to consent to. This page is the full inventory anyway: every piece of data the site can produce, where it goes, how long it lives and how to have it removed.
Four things exist.
None of them names you.
Everything this site can record, in one table. If a row is not here, it is not collected — the code is public and the analytics are self-hosted for exactly that reason.
| What | Where it goes | Kept for |
|---|---|---|
| Page views | Umami running on my own machine in France — not a third-party analytics service. The script is served from that machine, not from a CDN. | Aggregated indefinitely, as counts: path, referring host, coarse device class, country. No individual visit is reconstructable from what I read. |
| Request logs | Netlify, the host serving these files, keeps standard access logs — IP, time, path, user agent. | By Netlify, under their retention policy. I do not download or join them; the site has no dashboard that shows me individual visitors. |
| The address you type into the audit tool | One server-side request, then discarded. A structured log line records the outcome, status, duration and byte count — never the URL, the query string, your IP or your user agent. | The URL: seconds, in memory. The log line: as long as the hosting platform keeps function logs. Your IP: an in-memory rate-limit counter, cleared within 24 hours. |
| What you write to me | Email, in a mailbox I control. Booking a call goes through cal.eu, which has its own policy and its own record of the slot. | Until the conversation is over. Ask and the thread is deleted — no form, no account, no “data request” procedure. |
Nothing is set
on your device.
This site sets no cookies at all, first-party or third-party. That is why no consent banner appears: a banner asking permission for nothing is theatre, and it trains people to click “accept” without reading.
- Cookies
- none
- Advertising IDs
- none
- Fingerprinting
- none
- Session recording
- none
- Consent banner
- not needed, absent
- Local preferences
- 2 demo toggles, browser-side
The audit tool cannot
log a URL.
Not “we promise not to”: the logger accepts a fixed list of fields per event, and anything else is dropped before it reaches a log file. A URL has no field to go into, and a string that looks like one is replaced with [redacted].
What a log line contains
- Timestamp, ISO 8601, UTC.
- The event name —
audit.request,audit.probe,audit.refused. - Outcome, reason, duration in milliseconds.
- For a probe: HTTP status, bytes, truncation flag, redirect count.
What it does not contain
- The URL you audited, or any parameter in it.
- Your IP address, user agent, referrer or cookies.
- The HTML of the target — counted to the cap, then dropped.
- Anything that links one request to the next.
The security model documents the same boundary from the other side: what the audit reads, what it refuses, and where the implementation stops being able to help.
How to delete
what exists.
The honest answer for a visit is “there is nothing to delete”. The rest of this section is about the cases where something does exist.
Every other domain
that can see you.
Pages here are served from one origin. The list below is short on purpose — anything not on it is not loaded.
| Domain | When | What it learns |
|---|---|---|
| netlify.app | Every page load | That a request arrived: IP, path, user agent, as any host sees. No analytics product is attached to it. |
| home-server.tail582abc.ts.net | Every page load — the analytics script | A page view. It is my own machine; nothing is forwarded from it to an analytics vendor. |
| cal.eu | Only if you book a call | Whatever you enter into the booking form. Different company, different policy — you can simply write an email instead. |
| github.com · linkedin.com | Only if you follow a link | Nothing until you click; they then see a referrer and your normal browser fingerprint, as every site does. |
What you can ask for,
and of whom.
Under the RGPD you can ask what is held about you, ask for a copy, ask for correction, ask for deletion, and object to processing. In practice, for a visitor of this site the answer to all five is the same: nothing is held, so there is nothing to hand over, correct or delete.
Where something does exist — an email thread, a booking — the request is answered within one month, as the regulation requires. No fee, no form, no identity check beyond replying from the address in question.
- Who
- Yegor Gaidar, sole trader
- Where
- Paris, Île-de-France, France
- Contact
- maingaidar [at] gmail.com
- Response
- one month
- Supervisor
- CNIL, if unresolved
- Legal basis
- none needed — no personal data processed
Versioned, dated,
not retroactive.
If the site starts collecting something new — a contact form that posts to a server, an email list, a payment flow — this page changes in the same commit as the feature, with the date at the top and the new row in the table. A privacy policy that lags behind the code is a legal decoration.
Current version: 22 October 2026 · rewritten for the 2026 redesign, when the analytics moved fully to self-hosted Umami and the audit tool was added.
A privacy question
deserves an answer.
If something on this page does not match what you observe in your browser, that is a bug worth reporting — include the page and what the developer tools showed.