Privacy and cookie notice

Controller and contact

The controller is Artem Istranin, Berlin, Germany. For privacy questions or requests, email artem@istranin.dev.

Essential website operation

The site and its database are hosted on Google Cloud. Server requests necessarily include technical data such as your IP address, requested URL, time, and browser information. This data is processed to deliver and secure the site on the basis of legitimate interests in reliable and secure operation (Article 6(1)(f) GDPR).

Django sets a csrftoken cookie to protect form submissions. The privacy control stores your choice in your browser for up to six months. A random consent-receipt identifier and the notice version are stored with an affirmative choice so that the site can apply and demonstrate the preference you requested. These items are necessary for security or privacy-preference operation.

Consent-independent traffic counts

To understand overall traffic trends, a small first-party script sends one minimized signal when an eligible public page loads. The row contains the calendar date, public page path, broad page type, content slug, a coarse device category, a coarse browser family, and a reduced referrer source. External referrers are reduced immediately to a hostname. For same-site navigation, the internal source path may be retained so successful navigation between different public pages can be counted. The request user agent and browser-supplied referrer are reduced in memory; the raw user agent and full external referrer URL are not retained.

Course enrollment links send a minimized click signal containing the current course page before a write-free first-party redirect sends you to the external provider. The collector stores only the calendar date, course slug, and coarse browser family. This makes aggregate course click-through reporting possible without creating a visitor profile.

This traffic-counting tier does not store an IP address, query string, exact event time, cookie, browser or session identifier, and it does not attempt to identify unique visitors. It does not place or read cookies or similar browser storage. Staff sessions, obvious bots, speculative navigation, and non-public paths are excluded. The legal basis is the legitimate interest in measuring aggregate demand and improving site content (Article 6(1)(f) GDPR), balanced by strict data minimization and the absence of persistent identifiers. Minimized page-view and course-click rows are deleted after 90 days; daily aggregate counts may be retained for longer-term trend reporting and are available only to staff.

Optional analytics, advertising measurement, and embedded YouTube videos

You can consent separately to site analytics, ad measurement, and automatic loading of embedded videos. “Accept” enables all three; “Decline” enables none; “Choose” lets you save individual choices. Optional services run only for the purposes you select. The legal basis is your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG). You can refuse without losing access to the site and change or withdraw each choice at any time with “Privacy choices” in the footer. Site analytics helps improve content, ad measurement measures course-enrollment interactions for conversion reporting and bidding, and embedded videos make course videos available directly on article pages.

First-party analytics

The site records page paths, page type, the highest blog read-depth reached, selected links and course enrollment clicks, a random browser identifier, IP address, external referrer, and user agent. Staff sessions and obvious bots are excluded. Raw events are deleted after 90 days; aggregate reports without raw IP addresses may be kept for longer-term reporting. Analytics reports are restricted to staff users.

Before an optional purpose starts, the site stores a minimized consent receipt containing a random receipt identifier, the exact notice version, the purposes you selected, and the grant time. Consented site-analytics events reference that identifier only when analytics was selected. Withdrawal time is added when you later change or refuse a purpose. The receipt itself does not contain your IP address, browser identifier, or user agent and is retained only as long as needed to demonstrate consent for the associated processing and related legal obligations.

Google Analytics, Google Ads, and Google Tag Manager

With site-analytics consent, Google Tag Manager can load Google Analytics 4 for audience and site-usage measurement. With separate ad-measurement consent, a linked Google Ads account may use eligible enrollment events for conversion reporting and automated campaign bidding. Google may set _ga, _ga_*, and _gcl_* measurement cookies and process advertising click identifiers, IP address, device, browser, approximate location, page, referrer, session, and interaction data. Analytics storage is enabled only with site-analytics consent; advertising storage and advertising user-data processing require ad-measurement consent. Advertising personalization remains disabled, so neither choice enables personalized advertising or remarketing. Google Ireland Limited provides these services, and processing may involve transfers outside the EEA under the safeguards described by Google.

Google lists the default Analytics cookie lifetimes (_ga and _ga_*: two years) and the purposes and lifetimes of its advertising and measurement cookies. Actual cookies and lifetimes can depend on the active Google tag settings and your browser.

See Google’s privacy policy and Google’s Ads Data Processing Terms, which govern Google’s processing on the controller’s behalf for eligible processor services such as Google Analytics and Tag Manager. Most Google Ads services are classified separately as controller services, except for specific processor features on Google’s service list.

Newsletter subscriptions

If you subscribe, the site stores your email address and subscription time so it can send the updates you requested. The legal basis is your consent. The address is kept until you unsubscribe or ask for deletion; every newsletter should provide a way to unsubscribe.

After a successful signup, the newsletter_subscribed cookie remembers that this browser subscribed for one year. It contains only a status flag, not your email address or a subscriber identifier, and hides the blog subscription promotion when you return. It is separate from analytics and is removed when you clear the site's cookies.

Embedded media and external links

With embedded-video consent, YouTube videos in blog articles load automatically from YouTube’s privacy-enhanced domain. Without that choice, the site shows a local placeholder and contacts YouTube only after you select “Load video” for that video. This one-time action does not enable analytics or automatically load other videos. Vimeo and other external players load only after the same per-video action. Loading an external player shares technical connection and device data, including your IP address, with that provider under its own privacy terms. External links, including social networks, Udemy, and YouTube, are governed by the destination provider’s privacy practices once you follow them.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or objection, and you may withdraw consent for future processing. You may also lodge a complaint with a data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information.