---
title: "Privacy"
description: "What zapf.dev collects, which third parties it loads, and the site's policy on AI crawling and training."
source: "https://zapf.dev/privacy/"
---

This is a personal blog. It has no accounts, no login, no shopping cart and no newsletter, so there is
nothing here that asks you for personal data. What follows is an honest account of the little that is
collected anyway, and by whom.

## Analytics

The site uses [Umami](https://umami.is/) in production only. Umami is privacy-focused analytics: it sets no
cookies, does not fingerprint visitors, and does not build a profile that follows you across sites. What I
see is aggregate — page views, referrers, rough country, browser and screen size. I cannot tell who you are,
and I do not try to.

The script loads from `cloud.umami.is`. If you block it, the site works exactly the same; nothing on this
site depends on analytics running.

## Third parties that load in your browser

- **[Umami](https://umami.is/)** (`cloud.umami.is`) — analytics, as above. Production only.
- **[Giscus](https://giscus.app/)** (`giscus.app`) — comments on blog posts, backed by
  [GitHub Discussions](https://github.com/MatiasZapf/blog-comments/discussions). It loads only on post
  pages. If you post a comment you are doing so through your GitHub account, under
  [GitHub's privacy policy](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement),
  and the comment is public.
- **CDNs** (`cdn.jsdelivr.net`, `unpkg.com`) — used to load the diagram and audio-player libraries, and only
  on the pages that actually contain a diagram or an audio summary.

Fonts are served from this domain, not from Google Fonts, so no font request leaves the site.

## Hosting

The site is static and hosted on [Vercel](https://vercel.com/), which keeps standard server logs including
IP addresses for a limited period as part of operating the service. See
[Vercel's privacy policy](https://vercel.com/legal/privacy-policy).

## What I do not do

No advertising, no tracking pixels, no third-party marketing tags, no cross-site identifiers, no selling or
sharing of data with anyone. There is no mailing list, so there is no list to be added to.

## AI crawlers and training

Everything published here is meant to be read, quoted and linked — by people and by machines. Crawling is
open, and every page is available as clean markdown by appending `.md` to its URL, indexed at
[/llms.txt](/llms.txt).

Training is a different question, and I have answered it explicitly rather than by default.
[robots.txt](/robots.txt) declares:

```
Content-Signal: search=yes, ai-input=yes, ai-train=no
```

In plain terms: index this site and cite it, use it to answer someone's question in real time, but do not
use it as training data. The restriction is an express reservation of rights under Article 4 of EU Directive
2019/790.

I will be straightforward about the limits of that: `Content-Signal` is a young convention. It signals
intent in a machine-readable way; it does not enforce anything, and a crawler that chooses to ignore it will
not be stopped by a text file. It is a stated position, not a lock.

## Contact

Questions about any of this, or a request to remove something: [matias@zapf.dev](mailto:matias@zapf.dev).
More ways to reach me are on the [contact page](/contact/).