Skip to content
barts.work

Privacy

This page covers barts.work itself — the site you are reading. My apps have their own policies, because they run on your device and handle different things: Pickup is the current one.

The short version: this is a static personal site. It has no account system, no advertising, no tracking scripts, and no third-party embeds. It sets no cookies of its own and asks for no consent, because it does nothing that requires consent.

Who is responsible

I am — Bartosz Kustra, a private individual in Poland, acting as the data controller for this site.

Reach me at [email protected], or through App Support for anything app-related.

What the site stores on your device

One thing: your light or dark theme choice, kept in your browser’s localStorage under the key theme. It is written only when you press the theme toggle, read only to render the page the way you asked, and never sent anywhere. It stays in that browser until you clear your site data.

That is the entire list. No analytics cookies, no advertising identifiers, no fingerprinting, no session storage, no third-party scripts.

This is why there is no cookie banner. Under Polish law (art. 398 of the Prawo komunikacji elektronicznej, implementing the ePrivacy Directive), consent is required for storing or reading information on your device — unless it is strictly necessary for something you explicitly asked for. A theme preference you set yourself is exactly that exception. Nothing else on this site touches your device, so there is nothing to ask you about. A banner here would be theatre.

What happens when you visit

The site is hosted on Cloudflare Pages. Like any web server, Cloudflare’s network necessarily receives what your browser sends in order to deliver a page: your IP address, the URL you asked for, the referring page, your user agent, and the time. Cloudflare derives coarse statistics from this — page views, countries, browsers — which I can see in aggregate in its dashboard.

This is measured at Cloudflare’s edge from requests it is already handling. There is no analytics JavaScript on this site: nothing runs in your browser to measure you, and no beacon is sent. (An earlier version of this site loaded Cloudflare’s client-side analytics script. It was removed in September 2026 in favour of the server-side figures.)

Cloudflare may also set a short-lived __cf_bm cookie as part of its bot-management and security layer. That is Cloudflare’s, set at the network level rather than by this site’s code, and it exists to keep the site up rather than to profile you.

Legal basis: my legitimate interest (Art. 6(1)(f) GDPR) in serving the site securely and knowing roughly how much it is read. Retention follows Cloudflare’s own log periods; I do not keep a copy.

What happens when you write to me

The App Support form asks for which app, a topic, an optional device description, an optional email address, and your message. When you submit it:

  • The data goes to a small function on this site, which does not store it — there is no database, and message bodies are not logged.
  • It is handed to Resend, an email provider in the United States, which delivers it as a message to a mailbox I control, hosted by Google (Gmail). Mail sent to [email protected] reaches the same place through Cloudflare Email Routing.
  • I read it and, if you left an address, reply.

The email address is optional. Leave it blank and your message is genuinely anonymous to me, though I then cannot answer.

Legal basis: my legitimate interest (Art. 6(1)(f) GDPR) in supporting the software I publish and in answering people who contact me. Because Resend and Google are in the United States, that transfer relies on the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework.

I keep support correspondence for as long as it is useful — typically while the issue is open and for a reasonable period afterwards, in case you write again about the same thing.

What I never do

I do not sell, rent, or share your data. I do not use it for advertising, do not build profiles, and do not run automated decision-making. I have no newsletter and no mailing list, so nothing you send me is added to one.

The site links to GitHub, LinkedIn, YouTube, X, Firefox Add-ons, and other places. Those are ordinary links, not embeds — nothing from those services loads or runs until you choose to click through. Once you do, you are on their site and their privacy policy applies, not mine.

Fonts are self-hosted from this domain rather than fetched from Google Fonts, so reading a page contacts no one but Cloudflare.

Your rights

Under the GDPR you can ask me to give you a copy of your data, correct it, delete it, restrict how it is used, or hand it over in a portable form, and you can object to processing based on legitimate interest. In practice, for this site, that usually means an email thread you would like deleted — write to [email protected] and I will do it.

You also have the right to complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Children

Nothing here is directed at children, and I do not knowingly collect their data.

Changes

If how this site handles data changes, I will update this page and change the date below before the change goes live.

Last updated: 6 September 2026.