Privacy

Last updated: 1 November 2026. This notice describes the blog at marvinschmid.com.

Who is responsible?

Marvin Schmid operates this personal blog. Contact: contact@marvinschmid.com.

Hosting and delivery

Sevalla hosts the static website and uses Cloudflare’s edge network to deliver it. Requests necessarily include technical information such as your IP address, requested URL, and browser headers. Cloudflare processes request and security data to deliver and protect the website. The legal basis is my legitimate interest in reliable, secure delivery (Article 6(1)(f) GDPR). Cloudflare may process data outside the EEA under its applicable transfer arrangements. Sevalla is a Kinsta service; review its privacy policy and applicable processing agreement when that hosting provider is enabled. Cloudflare details are available in Cloudflare’s privacy notice and its data processing addendum. This blog does not keep a separate application access log.

Optional analytics

Self-hosted Umami is configured for this website. The operator uses an EU-hosted Umami instance for article views, estimated visitors, referrals, approximate location, browser/device information, language/category, and Affiliate Click and Article Read events. Article Read means that 75% of the article body has entered the viewport, not proof of reading. No names, emails, account identifiers or distinct user IDs are sent. Query strings and fragments are removed. This integration does not enable session replay, heatmaps, performance or error capture.

Standard Umami analytics do not store raw IP addresses as analytics fields, but IP addresses are processed transiently for delivery, estimated visitor identifiers and location. Server and network providers may keep separate operational/security logs. The HTTPS endpoint uses a Tailscale hostname, so delivery may involve Tailscale infrastructure. Analytics remain in the self-hosted database until deleted or reset by the operator. Private aggregate reports remain in Git history until removed. Contact me for questions or deletion requests. The hosted Umami Cloud service is not used.

Optional analytics load only after you accept. Consent is the legal basis for consent-dependent processing (Article 6(1)(a) GDPR). Reject or withdraw through Privacy settings in the footer. Withdrawal stops subsequent requests and does not affect earlier lawful processing. See Umami's metric definitions.

Browser storage

The selected light/dark theme is stored locally until you clear it. Your analytics choice is stored for up to 180 days so it can be respected. Neither preference is used for advertising. Cloudflare may additionally set strictly necessary security cookies such as __cf_bm (normally up to 30 minutes) to distinguish legitimate requests from bots. This security cookie was observed on the temporary hosting domain.

Contact and affiliate links

If you email me, I use your message and contact details to answer your request, based on my legitimate interest in responding to correspondence. I retain correspondence only as needed to respond and for applicable record-keeping duties. Articles with affiliate links identify that relationship. Visiting a merchant is subject to that merchant’s privacy notice. This site currently loads no display-ad scripts or newsletter service.

Your rights

Where GDPR applies, you may request access, correction, deletion, restriction, portability where applicable, or object to processing based on legitimate interests. You may withdraw consent at any time. Contact me using the address above. You can complain to IMY, Sweden’s data protection authority, or your local supervisory authority.