Personal data
What this site measures, and what it does not.
Kolofon measures traffic with its own code, with no third-party analytics scripts. Below is the exact inventory: what the server records in every case, what is added once you consent, how long it is kept and who else sees it. The inventory comes from measuring this site, not from a template.
Data controller: Paweł Gąsienica-Samek · kontakt@kolofon.dev
Without consent
The server records every page view. None of it is stored in your browser and none of it lets the site recognise you on your next visit.
The basis is the controller's legitimate interest (Art. 6(1)(f) GDPR): knowing which parts of the documentation are read and which ones fail. You can object by writing to the address above.
Identifiers — switched off
The engine can, with consent asked for in a banner, store two identifiers in your browser — a random browser identifier and a visit identifier — to see return visits, the path through the site and a fixed variant when two versions of a page are compared. Since 17 October 2026 (Kolofon 0.14.10, the telemetry.banner: false switch) that feature is off on kolofon.dev: there is no banner, no identifier is created, and consent clicked earlier is not used.
When A/B tests return, the banner and the question will return with them — and this document will change in the same commit. Until then the tab's session storage holds at most a marker that the button for the other language version has already pulsed once; it goes when you close the tab.
What is not here
No cookies. No third-party analytics, advertising or tracking pixels. No tracking beyond this site, and no selling or exchange of data. There are no reader accounts and no comments, so there is no name or address to collect. The only things in browser storage are technical session flags — the splash screen and the language-button pulse — that disappear when you close the tab.
How long
Events stay in the traffic log so that periods can be compared. The IP address is anonymised after 90 days: for IPv4 the last part is zeroed, for IPv6 the address is truncated. After that the log holds no field pointing at a particular connection.
Who else sees this
The data is not shared with anyone. One service does take part in serving the page and therefore sees the visitor's IP address: Cloudflare — hosting, database and its own traffic measurement. The company is based in the United States and processes data across its global network under the standard transfer mechanisms provided for in the GDPR. Typefaces are not fetched from any outside server — they sit on the same server as everything else.
Your rights
You have the right of access, rectification, erasure, restriction of processing and objection to processing based on legitimate interest. Write to kontakt@kolofon.dev.
One honest caveat: without consent there is no identifier at all, so finding “your” entries in the log requires your IP address and the approximate time of the visit. That is a side effect of measuring sparingly by default.
You may also lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, uodo.gov.pl).
Blocking the measurement
The measurement posts to /t on this domain and respects your browser's settings: blocking extensions and script-restricting modes switch it off entirely, and the site keeps working.