Privacy

Dmytro Hryniuk
Email: dhryniuk.work@gmail.com

Umami is a free, open-source tool for website statistics, a privacy-friendly alternative to Google Analytics. It shows me things like how many people visited, which pages they read and which countries they came from. I can also see single visits (pages, device, city), but without names or IP addresses. It doesn’t use cookies.

I run my own copy of Umami, so the visit data stays on my server and is not sent to the company that makes Umami. More about Umami: umami.is. The source code is public: github.com/umami-software/umami

I want to know which projects and pages get the most interest, which links people use (like “Download PDF”), where visitors come from, and whether a visit is a real person or a bot. I use this only to improve this site and my job applications, never for advertising. The legal basis is legitimate interest (Art. 6(1)(f) GDPR).

• the pages you open and how long you stay
• the site you came from, and campaign tags in the link (like utm_source)
• clicks on some links and buttons, for example “Download PDF”, email or LinkedIn
• browser, operating system, device type, screen size and language
• approximate location: country, region and city

Links I send with job applications can include a tag with the company name. Then I can see that the link was opened and from roughly which city, but not by whom. If I sent the link to only one person at that company, I may be able to guess it was them.

There are no screen recordings and no heatmaps.

Your IP address is used only during the visit: to look up the approximate location and to create a visit ID from your IP address and browser. The ID changes every month, so visits can be linked within a month but not across months. Umami does not store your IP address. The ID doesn’t show your name, but under GDPR it is still personal data.

Umami and the websites run on servers I rent from Hetzner Online GmbH in Germany (EU).

Requests to visitors.dhryniuk.com go through Cloudflare, Inc. (USA), which protects the connection. Cloudflare processes your IP address to deliver the request and to look up your approximate location. Because Cloudflare is a US company, data may go to the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and my data processing agreement with Cloudflare includes the EU Standard Contractual Clauses.

Cloudflare’s privacy policy: cloudflare.com/privacypolicy

The web servers keep short technical logs (time, page, browser) for 7 days for security and to fix errors (legitimate interest, Art. 6(1)(f) GDPR). These logs do not contain your IP address.

Analytics data: 24 months, then it is deleted. Backups: 30 days.

If your browser sends a Do Not Track signal, no analytics data is collected. You can also block visitors.dhryniuk.com in your browser or ad blocker. The sites work the same without it.

You can ask me which data exists about you, and ask me to correct it, delete it or limit how I use it. I don’t store names or IP addresses, so I usually can’t find a single visit.

You can object to the analytics at any time (Art. 21 GDPR). Just email me.

I don’t make automated decisions about you.

You can also complain to the data protection authority in your country.