Short version: reading this site needs no account and sets no tracking cookies. I count page views without cookies. For security, the IP addresses of visitors are kept for 7 days and checked against an abuse database. If you write to me, sign up for the chat or post in it, I keep what is needed for that, and you can have it deleted at any time.
1. Who is responsible
The controller within the meaning of Art. 4(7) GDPR for the processing on alexeysaltaganov.com is:
Alexey Saltaganov
Email: me@alexeysaltaganov.com
This is a private, non-commercial personal website. There is no data protection officer, as none is required (Art. 37 GDPR). For anything about your data, write to the address above.
2. Overview
| What | Data | Legal basis | Kept for |
|---|---|---|---|
| Delivering the site | IP address, request, browser, time | Art. 6(1)(f) | up to 7 days (logs) |
| Own page counter | page, a daily-salted hash | Art. 6(1)(f) | 90 days |
| Visitor security log | IP address, pages, browser, network, abuse score | Art. 6(1)(f) | 7 days after the last visit |
| Cloudflare Web Analytics | page, referrer, browser, country | Art. 6(1)(f) | aggregated by Cloudflare |
| Contact form | name, email, message, IP, time | Art. 6(1)(b), (f) | until settled, max. 12 months |
| Chat account | username, email, password hash or Google ID | Art. 6(1)(b) | until you delete it |
| Chat messages | username, text, time, IP | Art. 6(1)(b), (f) | newest 500 messages |
| Spam protection | Turnstile check (IP, browser signals) | Art. 6(1)(f) | not stored by this site |
3. Hosting and server logs
The site runs on Cloudflare (Workers, Durable Objects and R2 storage, Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). Every request passes through Cloudflare's network, which processes your IP address, the requested address, your browser's user agent, the time and technical connection data in order to deliver the page, protect it against attacks and keep it running.
Error and request logs of the site's own code (Workers Logs) are kept by Cloudflare for a few days, at most 7, and then deleted automatically.
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is delivering the site securely and reliably. Without this processing the site cannot be shown.
4. Visitor statistics
Own page counter
When you open the Stream, Archive or About page, your browser reports which of these pages it is. The site counts views per day and page. To count unique visitors it stores a one-way hash of your IP address and browser user agent combined with a random value that changes every day; that random value is deleted the next day, so the hashes can't be linked to you or to each other afterwards. The counter itself stores no IP address and sets no cookie.
If your browser sends Do Not Track or Global Privacy Control, nothing is counted. Statistics are deleted after 90 days.
Visitor security log
To recognise attacks, spam and abusive networks, the site keeps a short log of who opens its pages: your IP address, the pages you opened, when you first and last came, how many pages you viewed, your browser's user agent, and the country, city and network (provider, AS number) that Cloudflare derives from the IP address. This happens also when your browser sends Do Not Track, because it serves security, not statistics.
Each IP address is checked once a day against AbuseIPDB (see section 10), a public database of IP addresses reported for abuse. Only the IP address is sent; AbuseIPDB returns how often it was reported and what kind of network it belongs to. Only I can see the log. It is used to block abuse (for example in the chat) and for nothing else, is not combined with other data and is not used to profile you.
An IP address is deleted automatically 7 days after its last visit.
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is protecting the site, the chat and its users against attacks and abuse. You can object (section 12); write to me with your IP address and I will remove it.
Cloudflare Web Analytics
The pages also load Cloudflare Web Analytics, a privacy-focused statistics tool. According to Cloudflare it does not use cookies, does not store anything on your device and does not fingerprint visitors; it measures page views, referrer, browser and country, and page speed, and shows them to me only in aggregate form.
Legal basis for the page counter and Web Analytics: Art. 6(1)(f) GDPR. My legitimate interest is knowing, in aggregate, which pages are read and whether the site works well. As nothing is stored on or read from your device beyond what is needed to send the request, no consent under Art. 5(3) ePrivacy Directive is required. You can object at any time (section 12), and blocking static.cloudflareinsights.com in your browser stops the second tool.
5. Contact form
If you use the form on the About page, I process your name, email address and message, plus your IP address and the time of sending. The message is emailed to me through Resend (see section 10) and also kept in the site's storage so it isn't lost if the email fails. I use the data only to answer you.
Before sending, Cloudflare Turnstile checks that you are a person and not a bot. Turnstile processes your IP address and technical signals from your browser for this; the site only receives a yes or no.
Legal basis: Art. 6(1)(b) GDPR where your request is about a possible collaboration or agreement, otherwise Art. 6(1)(f) GDPR (my legitimate interest in answering messages and keeping the form free of spam). Giving the data is voluntary; without it I can't answer. You can also write to me directly by email, Telegram or Discord instead.
Retention: I delete messages once the matter is settled. Messages older than 12 months are deleted automatically.
6. Chat accounts
Reading the chat needs no account. To write in it, you need one, either with email and password or with Google.
Email and password
I store your username, your email address and your password as a salted hash (PBKDF2); the password itself is never stored. To confirm the address, the site emails you a link through Resend, which works once for 24 hours. "Forgot password" works the same way with a link valid for 1 hour. Sign-ups that are not confirmed within 7 days are deleted automatically.
To stop passwords being guessed, the site counts wrong passwords per email address entered at sign-in, whether or not that address has an account. After 5 within an hour, signing in with that address also needs the Cloudflare Turnstile check until the hour is over. Only the address, the number of wrong tries and the time of the first one are kept, and they are deleted after an hour or as soon as the right password is entered. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in keeping accounts safe.
Sign in with Google
If you choose "Continue with Google", you are sent to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), where you sign in. Google then tells the site your Google account ID and your confirmed email address; nothing else (no name, no profile picture, no contacts). Google's own processing is governed by Google's privacy policy. Google only learns that you signed in to this site when you choose this option.
Staying signed in
When you sign in, the site sets one cookie that keeps you signed in for 30 days (section 8). Only a hash of it is stored on the server, together with a short label of the browser and system it came from (e.g. "Firefox · Windows", taken from your browser's user agent) and when it was last used, at most to the hour. That's what lets you see and sign out your devices on the account page. Signing out ends it.
Account settings
On the account page you can change your username (once every 30 days; your chat messages take the new name), your email (confirmed by a link to the new address, valid for 24 hours; the old address is told about the change), your password (your other devices are then signed out), connect or disconnect Google, sign out devices, download everything stored about your account as a file (Art. 15 and 20 GDPR), and delete the account. When your password is changed or Google is connected or disconnected, the site emails your address with the time and the browser and system label of the device, so you notice if it wasn't you.
Legal basis: Art. 6(1)(b) GDPR, as the account is what you sign up for. Retention: until you delete the account (account page or account menu → "Delete account…"), which removes the account, its sessions and all its chat messages at once. Accounts banned for abuse are kept for the length of the ban so the ban can be enforced.
7. The #lobby chat
Messages you post are public: everyone who opens the site sees them with your username and the time. Please don't post personal information you don't want public. The site keeps the newest 500 messages; older ones are deleted automatically. With each message the site stores your IP address, which is never shown to other visitors and is used only to stop spam and abuse (for example to ban someone).
Legal basis: Art. 6(1)(b) GDPR for showing your messages, Art. 6(1)(f) GDPR for the IP address (my legitimate interest in keeping the chat free of abuse). The chat is not meant for children; please only use it if you are at least 16, or the age of digital consent in your country.
8. Cookies and local storage
The site uses no advertising or tracking cookies and no cookie banner, because the only cookies it sets are strictly necessary for a service you ask for (Art. 5(3) ePrivacy Directive, e.g. § 165(3) TKG 2021 in Austria, § 25(2) TDDDG in Germany):
| Name | Purpose | Duration |
|---|---|---|
| __Host-session | keeps you signed in to your chat account; only set when you sign in | 30 days, or until you sign out |
| __Host-oauth | protects "Continue with Google" against forged sign-ins | 10 minutes |
Your browser's local storage keeps the language you picked (alyst-lang). It never leaves your device. If you open the archive's Music section, SoundCloud and Spotify content is loaded, which may set their own cookies (section 9).
9. Fonts and embedded content
Pictures linked in posts
Posts and notes can show pictures that are stored on other websites (linked with Markdown). When you open such a post, your browser loads the picture from that website, which then receives your IP address and browser information. No referrer is sent, so it doesn't learn which page you were on. Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in showing posts with pictures. Pictures I upload myself come from this site.
Google Fonts
The site's typeface (Geist) is loaded from Google Fonts (Google Ireland Limited). For this, your browser connects to Google's servers, which receive your IP address and browser information. Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in a consistent appearance of the site.
Music section of the archive
The SoundCloud player and the Spotify card in the archive are only loaded when you open its Music section yourself. Then your browser connects to SoundCloud (SoundCloud Global Limited & Co. KG, Berlin, Germany), Spotify (Spotify AB, Stockholm, Sweden) and the embedding service Iframely, which receive your IP address and may set cookies. Legal basis: Art. 6(1)(a) GDPR, your choice to open that section. Until then nothing is loaded from them.
Links
Links to Telegram, Discord, GitHub and other sites are ordinary links; nothing is sent to those services until you click them.
10. Processors and transfers outside the EU
These providers process data on my behalf (Art. 28 GDPR) or as part of the services described above:
- Cloudflare, Inc. (USA): hosting, storage, content delivery, Turnstile, Web Analytics.
- Resend (USA): sending emails (confirmation links, password resets, contact form messages to me).
- Google (Ireland / USA): Google sign-in, only if you use it; Google Fonts.
- AbuseIPDB (Marathon Studios, Inc., USA): reputation checks of visitors' IP addresses (section 4). Only the IP address is sent.
Where data goes to the USA, the transfer is based on the EU–US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR) where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). I don't sell your data or pass it to anyone else, unless a law requires me to.
11. Security
The whole site is served over HTTPS only. Passwords are stored only as salted hashes; session cookies are HttpOnly, Secure and SameSite, and only their hashes are stored. Pictures in posts are re-encoded before upload, which removes location and camera data. Access to the site's administration is protected by a password and limited attempts.
12. Your rights
Under the GDPR you have the right to
- access the data I hold about you (Art. 15),
- rectification of incorrect data (Art. 16),
- erasure (Art. 17); you can delete your chat account yourself at any time,
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) (Art. 21),
- withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3)),
- lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU country where you live, work or where the alleged infringement took place. In Austria this is the Datenschutzbehörde (Barichgasse 40–42, 1030 Vienna, dsb.gv.at); in Germany, the authority of your federal state.
To use any of these rights, write to me@alexeysaltaganov.com. I answer within one month (Art. 12(3)). I may ask you to confirm that the account or messages are yours before deleting or handing out data.
13. Other information
There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. You are not obliged to provide any data; reading the site requires none, and the contact form, account and chat are optional. If the site or the law changes, I'll update this notice; the date at the top shows the current version.
14. Legal framework
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR)
- Directive 2002/58/EC (ePrivacy Directive), Art. 5(3), on storing and reading information on your device, as implemented in national law, e.g. § 165(3) Telekommunikationsgesetz 2021 (Austria) and § 25 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, Germany)
- Austrian Data Protection Act (Datenschutzgesetz, DSG) and German Federal Data Protection Act (BDSG), where applicable
- Commission Implementing Decision (EU) 2023/1795 (EU–US Data Privacy Framework) and Commission Implementing Decision (EU) 2021/914 (Standard Contractual Clauses)