Privacy and Cookie Policy
Version of 2026-09-20. In plain language, this explains what data I collect on mtokarski.dev, why, on what legal basis, how long I keep it and what rights you have.
1. Data controller
The controller of your personal data is Miłosz Tokarski. Contact on data matters: contact@mtokarski.dev.
2. What data, why, on what basis and for how long
Contact form. When you send a message, I store your name, email address and the message, the date it was sent, browser details and a technical hash of your network (not the IP address itself). Providing the data is voluntary, but without your name, email address and message I can't reply. I send an automatic confirmation to the address you give, and I store my replies with your message.
- Purpose: replying to your enquiry. Basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract), and where the enquiry is not about a service, Article 6(1)(f) GDPR (my legitimate interest in answering correspondence).
- Purpose: protecting the form from spam and abuse (a limit on messages per network, Cloudflare Turnstile verification). Basis: Article 6(1)(f) GDPR.
- Period: I automatically delete a message together with my replies from the database 12 months after receiving it, or right away on request. If we end up working together, data needed for the contract, accounting or defence of claims may be kept longer, on the basis of the law (Article 6(1)(b), (c) and (f) GDPR).
Visit statistics. Only if you agree, I count visits to the site (a visit counts once, however many pages you view): the date and time, the address of the page your visit started on, the source of the visit, the type of browser and system, and a technical hash made from your IP address and browser details that changes every day. I don't store the IP address and can't use this to track you from one day to the next.
- Basis: your consent, Article 6(1)(a) GDPR. You can withdraw it at any time, without affecting the lawfulness of processing before the withdrawal.
- Period: 13 months, after which the data is deleted automatically.
Proof of cookie consent. To be able to show that you made a choice in the banner, I store a random identifier from the cookie, your choice, the version of this policy, the date and browser details. I don't store your IP address or data that would let me identify you.
- Basis: Article 6(1)(c) GDPR in connection with Article 7(1) GDPR (the obligation to demonstrate consent) and point (f) (defence against claims).
- Period: 5 years, after which the data is deleted automatically.
I don't make automated decisions about you, don't profile visitors, don't sell data and don't use advertising or third-party marketing tools.
3. Cookies and similar technologies
| Name | Type | Purpose | Duration |
|---|---|---|---|
| cookie_consent | Essential | Remembers your cookie choice and a random consent identifier. | 6 months |
| Cloudflare Turnstile | Essential | Protects the contact form from bots. It loads only when you scroll to the form, and at that point Cloudflare receives, among other things, your IP address and browser details. | Per Cloudflare |
| sb-* | Essential | Login session. Set only after signing in to the admin panel; it doesn't apply to visitors. | Login session |
Statistics don't store any cookies or data in your browser. They work on the server side and only with your consent.
You can change your choice at any time: .
4. Recipients of data
Data is processed by my infrastructure providers under data processing agreements: Vercel (website hosting), Supabase (database), Resend (sending email: notifications to me, and confirmations and replies to you) and Cloudflare (form protection). If we settle through the Useme platform, its operator receives the data needed for settlement as a separate controller, under its own privacy policy. These providers may process data outside the European Economic Area, including in the United States, on the basis of mechanisms provided for in the GDPR: a European Commission adequacy decision or standard contractual clauses. You can get a copy of the safeguards by writing to contact@mtokarski.dev.
5. Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (UODO, uodo.gov.pl). To use your rights, write to contact@mtokarski.dev.
6. People under 16
The site is not aimed at children and I don't knowingly collect data from people under 16. If such data reached me through the form, a parent or guardian can write to contact@mtokarski.dev and I will delete it without undue delay.