Privacy policy
This site collects as little as possible. Below: what is processed, who handles it, and your rights.
Last updated:
Who is responsible
- Controller
- Jakub Łobos
- Address
- PO Box 10, 42C Wielicka Street, 30-552 Kraków, Poland
- hello@jakublobos.com
Write to this address for anything in this policy, including the requests described under “Your rights”.
What is processed, why, and for how long
Nothing is processed for advertising or sold. The table lists everything, with the legal basis under the GDPR (Art. 6(1)(a) consent, (b) steps before a contract, (f) legitimate interests). Transfers outside the EEA rely on the safeguards the provider offers under Chapter V of the GDPR.
| Data | Purpose | Legal basis | Where | Retention |
|---|---|---|---|---|
| Guestbook text, paint colour, page language | Show the newest approved message publicly and keep a private archive | Consent (you submit it voluntarily; a notice sits under the form) | Database on Railway, region EU West (Amsterdam) | Shown publicly until a newer message replaces it, then kept in a private archive of at most 100 messages until newer ones push it out. A message not yet reviewed is deleted after 24 hours at most. Deleted on request. Copies stay in the daily backups for up to 6 days. |
| Guestbook text sent to Google (Gemini API) for automated moderation | Safety check and suitability review | Legitimate interest | Google (Gemini API). Operated from the EEA, so the paid-service data terms apply; not used to improve Google products. Your IP address is not sent. | Logged by Google for 55 days for abuse monitoring |
| Contact form: name, email, message | Reply to your enquiry | Steps before a contract / legitimate interest | Resend (email delivery, in transit) passes name, email and message to the owner’s mailbox | Not stored by the site’s server. Resend keeps delivery logs per its own settings. The mailbox keeps the conversation for up to 12 months after the last message, or longer if it leads to a collaboration. |
| Browser signals and your IP address for the Cloudflare Turnstile check | Bot check before the phone number is shown or the resume is downloaded | Legitimate interest (securing a function you asked for) | Cloudflare. Loaded only after you click “Show number” or “Get my resume”; the API then sends your IP address to Cloudflare to verify the check. | Per Cloudflare |
| Technical request data: IP address, browser user agent, requested URL, time | Deliver the site and the API and protect them; rate limiting against abuse | Legitimate interest | Cloudflare (site) and Railway (API), as processors. For rate limiting the API keeps the IP address in memory only; the app never saves it to disk or writes it to logs. It is also sent to Cloudflare if you reveal the phone number or download the resume (see above). | Logs: per the hosts’ log retention. Rate limiting: a window of at most 24 hours, kept in memory only, never on disk or in logs; lost on restart. |
| Visit statistics (Google Analytics 4) | Visit statistics | Consent (“Accept”) | Google (US). Loaded only if you press “Accept” in the cookie banner. | 2 months, the shortest period GA4 offers |
| PostHog product analytics | With “Accept”: product analytics. With “Only essential”: counting visits in aggregate without storing anything on your device | With “Accept”: consent. With “Only essential”: legitimate interest | PostHog EU cloud. With “Accept” it uses its cookies; with “Only essential” it uses a server-side hash. Until you choose, it does nothing. | Per the PostHog project settings |
The guestbook has no accounts and the site stores no identifier with your message, so a message can only be found by its text. Please do not put personal data in it; the form rejects emails and phone numbers.
Whether a guestbook message is published is decided automatically by simple text rules and the Google (Gemini API) checks described in the table above. This has no legal effect on you. If you disagree, write to the address above.
Cookies and local storage
The first three entries are strictly necessary and used without your consent; the rest need it. Choose “Only essential” and nothing else is stored. You can change your choice at any time with “Cookie settings” in the footer; withdrawing consent stops Google Analytics, removes its cookies, and switches PostHog to cookieless counting.
| Name | Purpose | Set when | Legal basis | Lasts |
|---|---|---|---|---|
| lang (cookie) | Your explicit language choice | You use the language switch | Strictly necessary (you asked for it) | 1 year |
| jl-cookies (local storage) | Your cookie choice | You answer the cookie banner | Strictly necessary | Until you change it |
| jl-contact-draft (session storage) | Your unsent contact-form draft; never sent | You type in the contact form | Strictly necessary (you asked for it) | Until you close the tab or send the message |
| _ga, _ga_* (cookies) | Google Analytics | You press “Accept” | Consent | Per GA4 settings |
| PostHog keys (cookies and local storage) | PostHog analytics | You press “Accept” | Consent | Per PostHog settings |
Your rights
Under the GDPR you may ask me to:
- tell you whether I process your data and give you a copy (access),
- correct inaccurate data (rectification),
- delete your data (erasure), for example a guestbook message,
- limit the processing, or receive your data in a portable form where that applies,
- stop processing that is based on legitimate interest (objection).
Where processing rests on consent you can withdraw it at any time; this does not affect what happened before. To find a guestbook message, quote its text.
You may also complain to the supervisory authority: in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority in your own EU country.
Changes to this policy
If the site starts processing data differently, this page is updated first and the date above changes.