Privacy and cookie notice

Controller and contact

The controller is Artem Istranin, Berlin, Germany. For privacy questions or requests, email artem@istranin.dev.

Essential website operation

The site and its database are hosted on Google Cloud. Server requests necessarily include technical data such as your IP address, requested URL, time, and browser information. This data is processed to deliver and secure the site on the basis of legitimate interests in reliable and secure operation (Article 6(1)(f) GDPR).

Django sets a csrftoken cookie to protect form submissions. The privacy control stores your choice in your browser for up to six months. A random consent-receipt identifier and the notice version are stored with an affirmative choice so that the site can apply and demonstrate the preference you requested. These items are necessary for security or privacy-preference operation.

Consent-independent traffic counts

To understand overall traffic trends, a small first-party script sends one minimized signal when an eligible public page loads. The row contains the calendar date, public page path, broad page type, content slug, a coarse device category, a coarse browser family, and a reduced referrer source. External referrers are reduced immediately to a hostname. For same-site navigation, the internal source path may be retained so successful navigation between different public pages can be counted. The request user agent and browser-supplied referrer are reduced in memory; the raw user agent and full external referrer URL are not retained.

Course enrollment links send a minimized click signal containing the current course page before a write-free first-party redirect sends you to the external provider. The collector stores only the calendar date, course slug, and coarse browser family. This makes aggregate course click-through reporting possible without creating a visitor profile.

This traffic-counting tier does not store an IP address, query string, exact event time, cookie, browser or session identifier, and it does not attempt to identify unique visitors. It does not place or read cookies or similar browser storage. Staff sessions, obvious bots, speculative navigation, and non-public paths are excluded. The legal basis is the legitimate interest in measuring aggregate demand and improving site content (Article 6(1)(f) GDPR), balanced by strict data minimization and the absence of persistent identifiers. Minimized page-view and course-click rows are deleted after 90 days; daily aggregate counts may be retained for longer-term trend reporting and are available only to staff.

Optional analytics, advertising measurement, and embedded YouTube videos

Optional measurement runs and embedded YouTube players load only after you agree to optional services. The legal basis is your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG). You can refuse without losing access to the site and withdraw consent at any time with “Privacy choices” in the footer. Measurement is used to analyze site usage and improve content and marketing. YouTube embeds make course videos available directly on article pages.

First-party analytics

The site records page paths, page type, the highest blog read-depth reached, selected links and course enrollment clicks, a random browser identifier, IP address, external referrer, and user agent. Staff sessions and obvious bots are excluded. Raw events are deleted after 90 days; aggregate reports without raw IP addresses may be kept for longer-term reporting. Analytics reports are restricted to staff users.

Before optional measurement starts, the site stores a minimized consent receipt containing a random receipt identifier, the exact notice version and choices presented, and the grant time. Analytics events reference that identifier. Withdrawal time is added when you later refuse measurement. The receipt itself does not contain your IP address, browser identifier, or user agent and is retained only as long as needed to demonstrate consent for the associated measurement and related legal obligations.

Google Analytics, Google Ads, and Google Tag Manager

After consent, Google Tag Manager loads Google Analytics 4 for audience and course-enrollment interaction measurement. A linked Google Ads account may use eligible enrollment events for conversion reporting and automated campaign bidding. Google may set _ga, _ga_*, and _gcl_* measurement cookies and process advertising click identifiers, device, browser, approximate location, page, referrer, session, and interaction data. Analytics storage, advertising storage, and advertising user-data processing are enabled only with this consent. Advertising personalization remains disabled, so this choice does not enable personalized advertising or remarketing. Google Ireland Limited is the service provider, and processing may involve transfers outside the EEA under the safeguards described by Google.

See Google’s privacy policy and Google’s Ads Data Processing Terms, which govern Google’s processing of measurement and advertising data on the controller’s behalf where Google acts as a processor.

Newsletter subscriptions

If you subscribe, the site stores your email address and subscription time so it can send the updates you requested. The legal basis is your consent. The address is kept until you unsubscribe or ask for deletion; every newsletter should provide a way to unsubscribe.

Embedded media and external links

After you accept optional analytics and YouTube services, YouTube videos embedded in blog articles load automatically from YouTube’s privacy-enhanced domain. Without that consent, the site shows a local placeholder and contacts YouTube only after you select “Load video” for that video. This one-time action does not enable analytics or automatically load other videos. Vimeo and other external players load only after the same per-video action. Loading an external player shares technical connection and device data, including your IP address, with that provider under its own privacy terms. External links, including social networks, Udemy, and YouTube, are governed by the destination provider’s privacy practices once you follow them.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or objection, and you may withdraw consent for future processing. You may also lodge a complaint with a data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information.