Last updated: October 14, 2026
This Privacy Policy explains how hoicau.com and all of its subdomains (collectively, "this site") handle your data.
Data Minimization by Design
The site (hoicau.com) is a zero-tracking, fully static website built to collect as little information as technically possible:
- No advertisements and no third-party tracking scripts.
- No comment system or accounts required: No registration, login, or profiling on the main blog.
- Serverless static hosting: Hosted statically via Cloudflare Pages. I do not operate a private server or retain visitor databases.
- No cookies used: Your light/dark theme preference is stored exclusively in your browser's local/session storage; it never leaves your device and is never transmitted.
- Self-hosted assets: Web fonts, stylesheets, and icons are vendored and served directly from this site's static assets—no calls are made to Google Fonts or other asset CDNs during standard page loads.
The only data processing that occurs is standard edge server logging and optional aggregate analytics described below.
What Data Is Processed, and the Legal Basis
| Data | Purpose | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Edge server logs — IP address, user-agent, timestamp, requested URL (processed by Cloudflare) | Security, abuse prevention, and reliable content delivery | Legitimate interest — Art. 6(1)(f) |
| Cloudflare Web Analytics — aggregate page views, referrer, country, browser (cookieless; not loaded for EU visitors) | Understanding aggregate, non-identifying traffic trends | Legitimate interest — Art. 6(1)(f) |
| Sign-in identity (e.g. email) for protected subdomains | Authenticating authorized access via Cloudflare Zero Trust | Necessary to provide the requested service — Art. 6(1)(b)/(f) |
Under GDPR, an IP address is considered personal data. While this site never attempts to identify individuals from IP logs, IP addresses are necessarily processed transiently by Cloudflare to securely route requests.
Cloudflare Web Analytics
If enabled, this site utilizes Cloudflare Web Analytics, a privacy-first analytics tool that:
- Is completely cookieless;
- Uses no fingerprinting or persistent cross-site tracking;
- Records only aggregate, anonymized traffic statistics; and
- Is disabled entirely for visitors from the European Union (EU)—no analytics script or beacon is executed for EU visitors.
GDPR Compliance
This site is intentionally engineered for full GDPR compliance:
- Zero cookies and zero cross-site trackers.
- Complete analytics suppression for EU visitors.
- Edge server logging strictly limited to security and delivery operational requirements.
- No automated decision-making, behavioral profiling, or commercial data sharing.
International Transfers
Cloudflare is a US-based cloud infrastructure provider that operates a global CDN edge network. Where request processing involves personal data from the EEA/UK transferred outside those areas, such transfers are governed by Cloudflare's Data Processing Addendum (DPAs) incorporating European Commission Standard Contractual Clauses (SCCs). For details, consult the Cloudflare Privacy Policy and Cloudflare DPA.
Data Retention
I do not maintain any independent database of visitors. Edge logs and aggregate analytics are retained only for the transient durations dictated by Cloudflare's platform retention schedules, after which they are deleted or anonymized by Cloudflare.
Subdomains & Applications
Subdomains under hoicau.com may run specific self-hosted or open-source applications for personal use:
- Except for public services (such as rmtrackers.hoicau.com), all private applications are protected by Cloudflare Zero Trust (Access) and require identity authentication prior to access.
- During authentication, Cloudflare securely verifies your sign-in identity (such as an email address or SSO token).
External Links
This site contains links to external websites (such as GitHub). No third-party sharing widgets or tracking pixels are embedded. Third parties only receive referrer information if you intentionally click an external link. Each external site operates under its own independent privacy policy.
Your Rights (GDPR / UK GDPR)
If you reside in the EU, EEA, or UK, you hold statutory rights regarding your personal data:
- Right of Access to your processed data;
- Right to Rectification of inaccurate records;
- Right to Erasure ("Right to be forgotten");
- Right to Restriction of processing;
- Right to Object to processing based on legitimate interests;
- Right to Data Portability; and
- Right to lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, contact me at [email protected].
Contact
For questions or inquiries regarding this Privacy Policy, please reach out via email:
[email protected]
Changes to This Policy
This policy may be revised periodically to reflect architectural changes or regulatory updates. Any changes will be published here with an updated revision date.