Data processing

This site is static. It has no login, no database and no application backend — it serves files generated in advance. Most of what follows comes from that: most of the ways visitor data is collected today simply have nowhere to happen here.

The controller is Zdeněk Kubala, contact zdenek.kubala@ygg.cz. The server is located in the European Union and no data is transferred outside it.

What does not happen

• ▸ No cookies. The site stores none — neither analytical nor "essential". That is why there is no cookie banner: it would have no consent to ask for.
• ▸ No browser tracking. No analytics script, tracking pixel or SaaS service is loaded.
• ▸ No third-party servers. Fonts, icons and search are hosted here. Opening a page triggers not a single third-party request.
• ▸ No profiling and no automated decision-making.

What is recorded

The only source of operational data is the web server's ordinary access log. For each request it stores the time, host name, method, path, status code, response size, response time, referrer, browser identification and the full IP address, not truncated.

A full IP address is personal data and I am not going to pretend otherwise. Without it an attack cannot be recognised, a source of abuse cannot be blocked and the cause of an outage cannot be traced.

The path and the referrer are stored without the query string. That has one concrete consequence for search: it is recorded that you visited the search page, not what you searched for.

Error logs may contain the same fields and the same rules apply to them.

Search

The full-text search runs entirely in your browser over a downloaded index. The query is sent nowhere — there is no server to receive it.

What the browser stores

Your appearance choice and the accessibility panel settings are stored in your browser's storage so they survive closing the tab. They stay on your device, are never sent anywhere and are not an identifier. Clearing the site's data removes them.

Purpose and legal basis

The data serves the security and availability of the site, capacity planning and an aggregate view of traffic. The legal basis is legitimate interest under Article 6(1)(f) GDPR. Aggregate views are derived from these logs alone; nothing else is collected for them.

Retention and access

Access and error logs are kept for at most 365 days, including rotated copies and backups, and are removed automatically once that period ends. Aggregate views derived from them are not kept longer than the source logs.

The logs are not public. The controller and the hosting provider acting as a processor have access; nobody else receives them and they are never sold.

External content

The site embeds no third-party content. Were it ever to do so, the embed would load only after you click, and no connection to the provider would exist before that. Providers must be listed in advance in a versioned registry — today it is empty.

Ordinary links to other sites lead straight to their target. Once you follow one, that site's own policy applies.

Your rights

You have the right of access to your data, to its rectification or erasure, to restriction of processing, and the right to object to processing based on legitimate interest. Write to zdenek.kubala@ygg.cz.

Because only an IP address is stored, with no further identifier attached, I need your IP address and the approximate time of your visit to locate a record. Without them a record cannot be tied to a particular person.

You may lodge a complaint with the Czech Data Protection Authority, uoou.gov.cz.