Summary
This policy sets out what personal data Mediovsky collects, why, who processes it, and how to exercise your rights. In short: we collect the minimum needed to run the site and to reply when you write to us. No third party watches you here. The analytics is our own software on our own server: it sets no cookie, stores nothing on your device, and cannot see you anywhere else, which is why this site does not ask you about cookies. No ad network runs here: display space is sold directly, so there is no advertising script on the page, and fonts and images are served from our own domain.
The short version: when you email us we receive your message; your browser stores a couple of preferences locally on your own device; our hosting provider keeps standard server logs; we count how many people read each article without a cookie or a stored identifier; and page views are counted by our own analytics server, again without a cookie. Nothing is shared with an advertising network, because there is not one.
Data controller
The controller of personal data for Mediovsky is:
Mediovsky, operated by Mikołaj Salecki · salecki.digital
ul. Gen. Jasińskiego 11/51, 05-500 Piaseczno, Poland
NIP 1231052003 · REGON 361948200
Contact: [email address] · general enquiries: contact page
What we collect
| Category | Data | Source |
|---|---|---|
| Messages to us | Your name, email address, and the content of your message | Submitted through the contact form, which posts to our backend (api.mediovsky.com) and delivers your message to us by email via Resend. See “Processors.” |
| Reading list | Saved article slugs | Stored locally in your browser (localStorage). Never leaves your device. |
| Theme & notifications | Light/dark choice, which notifications you have read | Stored locally in your browser. Never leaves your device. |
| Newsletter | The email you type into the sign-up form | Submitted through the sign-up form to Resend (our email provider) with double opt-in. We store your email to send the newsletter until you unsubscribe. See “Processors.” |
| Server logs | IP address, user agent, request URL, status code, timestamp | Standard web-server logs kept by our hosting provider for security and operations. |
| Analytics | The address of the page (never its title), the website you arrived from (its hostname only), your window and screen size, your browser language and how long the page was visible; plus the browser, operating system, device type and country, region and city our server reads from the request itself | Kehai, our own analytics product, running on our own server (stats.kehai.io). No cookie, nothing stored on your device, nothing sent to a third party. See “Analytics.” |
| Article read count | A count of reads per article. No profile, no identifier stored about you | Our own counter on api.mediovsky.com, so we can show how often a piece is read and rank the “Popular this week” list. To count one reader once a day we derive a one-way hash from your IP address, your browser’s user agent, and the current date, then store only that hash. It changes every midnight (UTC) and cannot be linked back to you or followed across days. Your IP address is never stored. It sets no cookie, and it stays inside the EU. |
Why we use it
- Messages: to read and reply to what you send us.
- Local storage: to remember your theme, your reading list, and which notifications you have seen. This data stays on your device.
- Server logs: to operate and secure the site and debug errors.
Legal basis (General Data Protection Regulation, GDPR)
- Consent (Art. 6(1)(a)): writing to us (you choose to send the message) and subscribing to the newsletter (double opt-in).
- Legitimate interest (Art. 6(1)(f)): server security logs, basic site operation, our own article read counter, and the page-view statistics described under “Analytics.” Our interest is running an independent publication and knowing which pieces are read; we have weighed this against your rights and consider the impact minimal. Neither the counter nor the analytics sets a cookie, stores your IP address, builds a profile, or can recognize you on any other website.
Processors we use
We share the minimum necessary data with the following processors, each under a data processing agreement (DPA).
| Processor | Purpose | Location |
|---|---|---|
| OVH SAS (OVHcloud) | Hosting for the website, the analytics server and the email backend, plus server logs | Poland (EU) |
| Resend (Resend, Inc.) | Sending transactional and newsletter email (subscription confirmations, the newsletter, and handling of your inquiry). Stores your email address on our behalf while you are subscribed. | Ireland (EU) data region; provider US-incorporated, SCCs |
| Cloudflare, Inc. | Content-delivery/DNS proxy for the website and for the analytics server, and email routing (forwarding messages sent to our addresses to our inbox). | Global edge; provider US, SCCs |
There is no analytics company on this list, and that is the point. The software that counts page views is ours, on our own machine, and is described below.
Display advertising, when it runs, is sold directly and served from this site: a banner is an image and a link, with no third-party ad script, no ad network and no cross-site profiling. If that ever changes, this policy will be updated before it does.
Analytics
We measure how many people read what, with Kehai, the analytics product we build and run ourselves at stats.kehai.io, on our own server in Warsaw. Nothing about your visit reaches Google or any other company at any point.
What it does not do. It sets no cookie. It writes nothing into your browser’s storage and reads nothing from it. It cannot recognize you on any other website, because the way it tells readers apart works on this one site alone. It builds no profile, feeds no advertising audience, and its numbers are not sold or shared.
What it does. Your browser sends the address of the page (never its title), the hostname of the site you arrived from (never the full address), your window and screen size, your browser language, and how long the page was visible. Our server adds what it can read from the request itself: browser, operating system, device type, and the country, region and city your Internet address belongs to. The address itself is used to work those out and is never stored or logged.
How one reader is told from another. There is no identifier for you, on your device or in our database. The server derives a one-way hash from the site, your Internet address and your browser’s user agent, together with a secret value that is replaced every midnight UTC. It counts a person once a day on this site, means nothing on any other site, and after midnight nothing can connect one day to the next. The hash cannot be reversed and points at nobody.
Why we do not ask you first. Article 5(3) of the ePrivacy Directive, the rule that produced cookie banners, is about storing or reading information on your device. This stores and reads nothing there, so there is nothing to consent to. The statistics themselves rest on our legitimate interest (Art. 6(1)(f) GDPR) in knowing which articles are read, weighed against your rights: no cookie, no identifier, no profile, no third party, and nothing that follows you off this site. You can object at any time, and you can also simply switch it off.
How to switch it off. Two ways, and we honor both. Turn on Do Not Track in your browser and nothing is sent. Or block stats.kehai.io in a content blocker; the site works exactly the same either way.
Retention
| Data | Retention |
|---|---|
| Emails you send us | 12 months from our last reply, unless an ongoing matter requires longer |
| Newsletter subscription (your email address) | Until you unsubscribe (one click in every issue), then removed |
| Page-view statistics (Kehai) | Kept as statistics, because that is all they are: no identifier for you is stored with them. The hash that groups one reader’s page views cannot be reversed and stops matching when the secret is replaced, every midnight UTC |
| Article read counts | The per-article totals are kept indefinitely, because they are counts and identify nobody. The daily de-duplication hashes are deleted after two days |
| Proof that you confirmed your newsletter subscription | A one-way hash of your address, with the time you asked and the time you clicked the confirmation link. Your address itself is not stored in it, and the hash cannot be turned back into an address or a mailing list. We keep it while you are subscribed, so we can show that you asked to be, and delete it with your subscription when you unsubscribe or ask us to |
| Server logs | Per our hosting provider’s standard log rotation (short-term, for security/operations) |
| Browser local storage | Until you clear it in your browser |
Your rights under GDPR
You have the right to:
- Access: request a copy of personal data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete your data (“right to be forgotten”).
- Restriction: limit how we process your data.
- Portability: receive your data in a portable format.
- Object: object to processing based on legitimate interest.
- Withdraw consent: at any time, with no impact on prior processing.
- Complain: to your local supervisory authority (in Poland: UODO).
To exercise any of these rights, email [email address]. We respond within 30 days.
Cookies & local storage
This site sets no cookie of its own. Your browser may hold cf_clearance and __cf_bm, set by Cloudflare and strictly necessary to serve the page at all. Everything else is stored in your browser’s localStorage, on your device only:
mediovsky-theme: your light/dark preferencemediovsky-saved: your reading listmediovsky-bell-read: which notifications you have already seen
You can clear these at any time via your browser settings without affecting site functionality.
International data transfers
Website hosting, the analytics server and server logs all stay within the European Union (OVHcloud, Warsaw, Poland), and our email provider Resend processes in an Ireland (EU) data region. Two of our processors are US-incorporated: Cloudflare (content-delivery/DNS proxy and email routing) and Resend (email delivery). Where their processing may involve access from the United States, we rely on the European Commission’s Standard Contractual Clauses (SCCs) as the transfer safeguard.
What leaves your browser, stated plainly. Two hosts, both ours. The page itself comes from this domain. The analytics request goes to stats.kehai.io, our own server, and like any request it reveals your Internet address and which page you are on. That is the floor, and it is the same floor as loading the page at all. Both hosts sit behind Cloudflare’s edge, which is why Cloudflare is on the processor list.
Minors
Mediovsky is written for marketing and tech business professionals. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with data, contact [email address] and we will delete it promptly.
Changes to this policy
We post material changes here with a new “Last updated” date. Non-material clarifications may be made without notice. For active newsletter subscribers, we email a summary of any material change.
Contact
Questions about privacy or your data: [email address]. General contact: contact page.