Privacy

This is a personal blog. It has no accounts, no login, no shopping cart and no newsletter, so there is nothing here that asks you for personal data. What follows is an honest account of the little that is collected anyway, and by whom.

Analytics

The site uses Umami in production only. Umami is privacy-focused analytics: it sets no cookies, does not fingerprint visitors, and does not build a profile that follows you across sites. What I see is aggregate — page views, referrers, rough country, browser and screen size. I cannot tell who you are, and I do not try to.

The script loads from cloud.umami.is. If you block it, the site works exactly the same; nothing on this site depends on analytics running.

Third parties that load in your browser

• Umami (cloud.umami.is) — analytics, as above. Production only.
• Giscus (giscus.app) — comments on blog posts, backed by GitHub Discussions. It loads only on post pages. If you post a comment you are doing so through your GitHub account, under GitHub’s privacy policy, and the comment is public.
• CDNs (cdn.jsdelivr.net, unpkg.com) — used to load the diagram and audio-player libraries, and only on the pages that actually contain a diagram or an audio summary.

Fonts are served from this domain, not from Google Fonts, so no font request leaves the site.

Hosting

The site is static and hosted on Vercel, which keeps standard server logs including IP addresses for a limited period as part of operating the service. See Vercel’s privacy policy.

What I do not do

No advertising, no tracking pixels, no third-party marketing tags, no cross-site identifiers, no selling or sharing of data with anyone. There is no mailing list, so there is no list to be added to.

AI crawlers and training

Everything published here is meant to be read, quoted and linked — by people and by machines. Crawling is open, and every page is available as clean markdown by appending .md to its URL, indexed at /llms.txt.

Training is a different question, and I have answered it explicitly rather than by default. robots.txt declares:

Content-Signal: search=yes, ai-input=yes, ai-train=no

In plain terms: index this site and cite it, use it to answer someone’s question in real time, but do not use it as training data. The restriction is an express reservation of rights under Article 4 of EU Directive 2019/790.

I will be straightforward about the limits of that: Content-Signal is a young convention. It signals intent in a machine-readable way; it does not enforce anything, and a crawler that chooses to ignore it will not be stopped by a text file. It is a stated position, not a lock.

Contact

Questions about any of this, or a request to remove something: matias@zapf.dev. More ways to reach me are on the contact page.