Contact

Privacy Policy

What reevik.net records about you, why, for how long, and how to have it removed.

Last updated: 6 November 2026

This page explains what personal data reevik.net processes when you read it, subscribe to the newsletter, join a waitlist, like a post or write to me. It is written for the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Who is responsible

Erhan Bağdemir runs reevik.net as a personal blog and is the controller for the processing described here. Write to erhan@reevik.net about anything on this page. See also the Imprint.

Short version

  • No cookies. reevik.net sets none, and no third party sets any unless you start an embedded video or audio player.
  • Anonymous visitor statistics come from Plausible, which uses no cookies and stores no IP addresses.
  • Server logs hold your IP address for 14 days, then they are deleted automatically.
  • Your email address is stored only if you subscribe or join a waitlist and then confirm by email. Unconfirmed addresses are deleted after 30 days. Every email includes a link that removes your address straight away.

Hosting and server logs

The site and its API run on a server rented from STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which acts as processor under a data processing agreement (Art. 28 GDPR). The data stays in Germany.

When your browser requests a page, the web server records your IP address, the date and time, the requested address, the HTTP status and size of the response, the referring page and your browser’s user-agent string. Error logs can hold the IP address and the request too. The server needs these records to deliver the site and to find faults and fend off attacks (Art. 6(1)(f) GDPR, legitimate interest in a secure, working website).

Retention: log files are deleted or trimmed automatically after 14 days. Log entries from an actual attack on the site may be kept longer, for as long as dealing with that incident needs. They are kept apart from the regular logs and only the operator can read them.

Visitor statistics (Plausible Analytics)

To see which posts are read, reevik.net uses Plausible Analytics, run by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, on servers in the EU. Plausible sets no cookies and stores nothing on your device. From your IP address and user agent it derives an identifier that is hashed with a salt that changes every day. The identifier is never stored in a way that can be reversed, and it cannot follow you across days or sites. What remains are aggregated figures: page views, referrers, country, browser and device type. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing how the blog is used). Plausible acts as processor.

Newsletter

If you enter your email address in the newsletter form, the reevik.net API stores the address, a random confirmation token, the time of sign-up and whether you have confirmed. It then sends one email with a confirmation link (double opt-in). You are subscribed only when you open that link and press Confirm.

  • Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, and doing so does not affect what happened before.
  • Removal: every email has a Remove your address link that deletes your entry at once. You can also just email me.
  • Unconfirmed sign-ups are deleted automatically after 30 days.
  • Emails are sent from reevik.net’s own mail server at STRATO. No newsletter service is involved.

Waitlists

Some project pages let you join a waitlist so you hear when the product is ready. The API stores your email address, the product you signed up for, a confirmation token, the time of sign-up and whether you have confirmed. The rules are the newsletter’s: double opt-in, consent as the legal basis, a removal link in every email, and unconfirmed entries deleted after 30 days. A confirmed entry stays until you remove it or the waitlist is closed, whichever comes first.

Contact form

The contact form sends your name, email address and message to my mailbox at reevik.net. The API does not keep a copy in its database. I use the details to answer you, and I delete the email when the conversation is over, unless the law requires me to keep it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering messages), or Art. 6(1)(b) where your message is about entering into a contract.

Spam and abuse protection

All forms use ALTCHA, a proof-of-work puzzle that your browser solves by itself. It is served from reevik.net, contacts no third party and sets no cookies.

To stop the forms being used to send email to people who never asked for it, the API also does the following:

  • It compares the IP address of each request with the public list of Tor exit nodes and refuses form submissions that come through Tor. The list is downloaded from the Tor Project; your address is never sent anywhere.
  • It counts, in memory only, how many emails went to one address in the last day, and sends no more above a small limit. The counters are not written to disk. They are discarded after two days at most, and whenever the server restarts.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the service and third parties from abuse).

Likes

The heart under a post adds one to an anonymous counter. The server stores only the count. To stop you liking a post twice, your browser keeps a note in its local storage (see below).

Local storage in your browser

The site keeps a few settings in your browser’s local storage: dark or light theme (theme), list or grid view (classView), your bookmarked posts (bookmarks) and which posts you have liked (liked:…). These values never leave your device, are not sent to the server and are not used to recognise you. They exist only so the features you use work (§ 25(2) no. 2 TDDDG). You can delete them at any time in your browser’s settings.

Embedded videos and audio

Some posts include videos or audio from YouTube (Google Ireland Limited, Ireland), Vimeo (Vimeo.com, Inc., USA) or SoundCloud (SoundCloud Global Limited & Co. KG, Germany). Until you click the play button, only a placeholder is shown and nothing is loaded from the provider. Clicking loads the provider’s player. The provider then receives your IP address and browser details and may set cookies or similar identifiers under its own privacy policy. Legal basis: your consent, given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). For providers outside the EU, transfers rely on the EU–US Data Privacy Framework or the provider’s standard contractual clauses.

Links to GitHub, LinkedIn, X and other sites, including the share buttons under posts, are plain links. Nothing is sent to those sites unless you click one, and from then on their own privacy policies apply.

Your rights

Under the GDPR you have the right to:

  • access the data stored about you (Art. 15) and receive a copy (Art. 20),
  • have it corrected (Art. 16), deleted (Art. 17) or its use restricted (Art. 18),
  • object to processing based on legitimate interest (Art. 21),
  • withdraw any consent at any time, with effect for the future (Art. 7(3)).

Email erhan@reevik.net to use any of these rights.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for reevik.net is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), www.datenschutzzentrum.de.

No decision about you is made by automated means, and no profile of you is built.

Changes

This policy changes when the site does. The date at the top shows the latest version.

Reading List