# Privacy Policy

What spoko.space collects, why, for how long, and how you can control it.

**Canonical:** https://spoko.space/privacy/
**Language:** en

---

_Last updated: 5 September 2026_

This site is run by one person, and it collects as much as it needs to work and to tell me whether anyone is reading. Here is exactly what, why and for how long.

## Who is responsible for your data

The data controller is **Szymon Berski**, trading as spoko.space, based in Bielsko-Biała, Poland.

For anything concerning personal data, write to [contact@spoko.space](mailto:contact@spoko.space). I answer personally.

## Visit statistics

I use Google Analytics 4 to see which posts people read and where they arrive from. I do not sell this data, do not combine it with any other source, and run no advertising — Google's advertising signals are **permanently off** here, and no button turns them on.

Before you answer the cookie question, visits are counted in cookieless mode. Google receives the bare fact that a page was viewed, along with what any browser sends anyway: the page address, the previous page address, the browser type, the screen resolution, and an approximate location derived from your IP address. The **IP address itself is not stored** in this mode, and the data cannot identify you as a returning visitor.

If you agree, `_ga` cookies are added, which let a returning visit be told apart from a new one.

- **Legal basis**: your consent to cookies (Art. 6(1)(a) GDPR). Before consent, the data is anonymous and is not personal data.
- **Recipient**: Google Ireland Limited.
- **Retention**: Google Analytics keeps event data for at most 14 months.

You can withdraw consent at any time — the **Cookie settings** link sits in the footer of every page.

## Contact form

If you write through the form, I receive what you type into it: your name, email address, the message, and an indicative budget if you pick one. There are no hidden fields.

The message goes to the `api.spoko.space` server and from there to my mailbox.

- **Legal basis**: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for enquiries unrelated to a project, my legitimate interest in replying to them (Art. 6(1)(f) GDPR).
- **Retention**: until the conversation ends. If it turns into a project, accounting records are kept for as long as tax law requires.

## Spam protection

The form is protected by Cloudflare Turnstile. Before a message is sent, Turnstile checks signals from your browser to tell a human apart from a bot. This runs **without asking for consent**, because without it the form would fill with spam within days.

- **Legal basis**: legitimate interest in securing the site (Art. 6(1)(f) GDPR).
- **Recipient**: Cloudflare, Inc.

## Hosting

The site runs on Cloudflare Pages and the form backend on shared hosting at Hostido. Both keep standard server logs that include IP addresses — a technical necessity of any web server, not a separate analytics tool.

## What is stored in your browser

| Name | Set by | Purpose | Lifetime |
| --- | --- | --- | --- |
| `_ga`, `_ga_*` | Google Analytics | Telling a returning visit apart from a new one | 2 years |
| Turnstile token | Cloudflare | Confirming a human sent the form | Up to 30 minutes |
| `spoko:consent` | this site | Remembering your cookie decision | 12 months, then I ask again |
| `spoko:locale-suggest-dismissed` | this site | Not offering the language switch twice | Until you clear your browser |
| `theme` | this site | Remembering light or dark mode | Until you clear your browser |

The last three are `localStorage`, not cookies — they are never sent anywhere and do not leave your browser.

## Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability, and to object to processing based on legitimate interest. You can withdraw consent to cookies at any time, and withdrawing it does not affect what happened before.

To exercise any of these, an email to [contact@spoko.space](mailto:contact@spoko.space) is enough.

If you believe I am processing your data unlawfully, you can lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

## Changes

If I add a tool that collects data, I will update this page and ask for consent again — even if you have already given it once.