Privacy policy

Who runs this site

This site is run by me, Tomasz Smialowski, a resident of Poland, as my professional website. That makes me the data controller. For anything about privacy or any of your data, write to tomasz@smialowski.pl; the message comes straight to me.

What this site does not do

• Without your consent, it sets no analytics cookies and loads nothing from Google.
• It has no accounts, login, contact forms, comments or newsletter.
• It contains no ads, marketing pixels or social media plugins.
• It does not try to recognize your browser or device by fingerprinting.
• It does not sell any data and does not use it for advertising.

Visit statistics and cookies (Google Analytics)

I want to know whether anyone reads this site, so I use Google Analytics 4, a service of Google Ireland Limited. The script loads only after you consent, that is, after you click “I agree” in the window that appears on your first visit. If you decline or choose nothing, the site does not connect to Google Analytics at all.

After you consent, Google Analytics collects:

• the pages you visit and the address of the referring page (referrer),
• your browser, operating system, device type, screen resolution and language,
• your approximate location (country, region, city), derived from your IP address,
• the length of the visit and whether the page was scrolled to the end,
• clicks on links that lead off this site (the destination address and the page where the click happened are recorded),
• a click on the button with my email address, only the fact that it was clicked,
• a visit to an address that does not exist here (a 404 error), so that I can fix a broken link.

In doing so, it stores two cookies in your browser, valid for up to 13 months from your last visit:

_ga

A random identifier that Google Analytics uses to tell one browser from another.

_ga_<id>

The state of the current visit, so that several page views count as one visit.

You can withdraw your consent at any time with the “Cookie settings” button at the bottom of every page, or here: Cookie settings. After you withdraw it, the site deletes the Google Analytics cookies and stops loading its script.

Your choice itself, consent or refusal, is remembered in your browser’s storage (local storage) under the name analytics-consent, so that the site does not ask on every visit. This entry contains only the word “granted” or “denied”, no identifier, and is never sent anywhere. It does not require consent, because without it the question window would come back on every page: Article 399(3)(2) of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) exempts from the consent requirement storage that is necessary to provide a service you have requested.

In an exceptional situation, for example during an attack on the site, Cloudflare may consider the traffic from your browser suspicious, show a short check and, once you pass it, store the cookie cf_clearance. It serves only to protect the site, so it does not require consent either. During an ordinary visit, Cloudflare stores no cookies at all.

You can also control what is stored in the browser itself: block cookies, delete them when you close the window, or clear this site’s data. You will usually find this in the settings, under Privacy or Cookies and site data. The site works the same without cookies, and after you clear its data it will ask for your consent again.

Technical data and who else handles it

To send you this site at all, the server that delivers it has to process your IP address and the details of the request (the page address, your browser, the time, the page you come from). I keep no visit logs of my own. Cloudflare keeps traffic logs for a limited time, to protect the site against attacks and to fix outages, and does not give a single period for all data. Security events, for example a blocked request, are visible in the Cloudflare dashboard together with the IP address for 31 days.

One provider takes part in running the site, a second one is added after you consent to statistics, and a third one if you write to me:

Cloudflare

Hosts this site and delivers it to you, and also handles the HTTPS connection. There is no single server in a single country: the site is sent from whichever Cloudflare data center is closest to you. The service is provided by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA), on my behalf, as a processor.

Google Analytics

The statistics described above, only after your consent. The service is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), as a processor, and the data may be transferred to Google LLC in the USA.

Proton Mail

My email, if you decide to write to me. The service is provided by Proton AG (Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland).

Public authorities may also receive data if they request it under the law.

Some data may be processed outside the European Economic Area. The transfer to Google LLC and Cloudflare, Inc. in the USA is based on the European Commission’s decision of July 10, 2023 on the EU-US Data Privacy Framework, in which both companies participate. In case that decision ceases to apply, both companies also use the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). Proton is based in Switzerland, for which the European Commission has found an adequate level of data protection. I will send you a copy of these safeguards if you ask at tomasz@smialowski.pl.

If you write to me

If you write to tomasz@smialowski.pl, I process your address, sender name and the content of the message for one purpose: to read it and reply. I do not add you to any list or use them for anything else, and they go nowhere except my Proton Mail inbox.

I keep the message until the matter is settled, and then for at most 12 months, in case the matter comes back. Writing to me is voluntary, but without an email address I cannot reply.

External links

As for external sites, the homepage links to the sites of my games: grodowo.pl, osiedlandia.pl and zenogrod.pl. I run those sites myself too, and each has its own privacy policy. Every page also links to my profile on X (x.com). This policy links to pages of Google and of the Polish Personal Data Protection Office (Urząd Ochrony Danych Osobowych). The notes may contain links to other sites when I write about a specific tool or source. Once you go to someone else’s site, its privacy rules apply, and I have no influence over them. Merely displaying a page sends nothing to those sites.

The interactive demos under /demo/ are part of this site, although they have a look of their own, without the header and footer. They run entirely in your browser and load nothing from external sites. They do not use Google Analytics and set no cookies, which is why they do not ask for consent.

Legal basis and your rights

Google Analytics statistics and its cookies are based solely on your consent (Article 6(1)(a) GDPR and Article 399(1) of the Electronic Communications Law). Withdrawing consent does not affect the lawfulness of what happened before it. The processing of technical data needed to send you the site and to protect it (including Cloudflare’s protective cookie), as well as replying to your message, is based on legitimate interest (Article 6(1)(f) GDPR): I want the site to work and be secure, and I want to be able to reply to you. After the matter is settled, I keep the data on the basis of legitimate interest, so that I can establish, exercise or defend legal claims.

You do not have to provide any data to browse the site. I do not make decisions about anyone based solely on automated processing, including profiling.

You have the rights the GDPR gives you: access to your data, rectification, erasure, restriction of processing, data portability and withdrawal of consent. One email to tomasz@smialowski.pl is enough. I will reply without undue delay, and within one month at the latest.

I do not know your name or email address until you write to me, and the Google Analytics identifier is random, so I will usually not be able to tell which data relates to you specifically. If you want me to find or delete your data in Google Analytics, give me the value of the _ga cookie from your browser: without it, I have no way of finding it (Article 11(2) GDPR).

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO) (ul. Stawki 2, 00-193 Warszawa), or, if you are in another EU or EEA country, with the supervisory authority there.

Changes

If the way the site works changes, for example if a different analytics tool is added or anything else that affects your data, I will update this page and the date at the top. If a change requires your consent, I will ask for it again.