Privacy policy

What data dualfroz.com collects, why, on what legal basis, who receives it and how long it is kept.

In effect from

In short

  • The site has no analytics and no ads: it does not load Google Analytics, ad pixels or any other tracking scripts.
  • Apart from server logs, data is stored only when you do something: send a message, draw a candy or arrive through a referral link.
  • The site sets one cookie, lang, holding the language you picked.
  • Access, correction or deletion of your data takes one email to me@dualfroz.com.

Who is responsible for your data

The controller of personal data collected by dualfroz.com is Michał Fox, known online as DualFroz, a private individual who runs this site personally.

Controller
Michał Fox (DualFroz)
Address
Kraków, Poland
Email
me@dualfroz.com

For anything related to your data, write to me@dualfroz.com.

This policy provides the information required by Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

Contact form

A message sent from the Contact page goes straight to me.

What
Your name or nickname, the subject, the message and your email address, if you give one. The server adds your IP address, browser information (the User-Agent header, up to 300 characters) and the time of sending.
Why
To read the message, reply and carry on the conversation you started.
Legal basis
Article 6(1)(f) GDPR: my legitimate interest in answering correspondence. When you write about a commission or working together, also Article 6(1)(b) GDPR: steps taken at your request before entering into a contract.
Where it goes
The whole message is saved to a file on the site's server. A Discord notification receives the name, subject, email address and the first 1000 characters of the message. The IP address and browser information stay on the server only.
How long
Until the matter is dealt with. The site does not delete messages automatically: I delete them by hand, from the server and from Discord. You can ask for earlier deletion at any time.

Protection against spam and abuse

Cloudflare Turnstile protects the contact form and the candy jar. The widget loads from Cloudflare's servers and checks that a human is using them. While doing so, Cloudflare processes your IP address and data about your browser and device. After you send the form or draw a candy, the site's server passes the widget token and your IP address to Cloudflare to confirm the result.

The server also counts requests from each IP address and rejects the excess. The form accepts at most 5 messages within 15 minutes; the candy jar, referral links and the jar app have limits of their own.

What
Your IP address and the times of your requests, kept in a counters file.
Legal basis
Article 6(1)(f) GDPR: protecting the site from spam, bots and overload.
How long
Only for the length of the limit window, from 15 minutes to 24 hours. The entry is removed on the first counter update after the window ends.

Referral links

Links with a referral code, that is dualfroz.com/ref/<code> or an address ending in ?ref=<code>, show me where visitors come from. The site removes the code from the address bar right after you arrive.

What
The referral code, the time of the visit and a random visit identifier that the site keeps only in the memory of the open tab: it is not stored in your browser and disappears when the tab is reloaded or closed. When it is missing, the server uses a daily pseudonym instead, an HMAC-SHA256 hash of the IP address, the date and a secret key. Every further page opened in the same tab records a view with the same code. The browser also sends the page address, but the server does not store it.
Why
To know how many people and page views each link brought.
Legal basis
Article 6(1)(f) GDPR: my legitimate interest in measuring how my own links perform.
Where it goes
The list of visits is kept in a file on the site's server. The Discord notification contains only the code and totals (sessions, views, most used codes), with no IP address and no identifier.
How long
The list of visits is not deleted automatically: I keep it for as long as the link statistics need it. On request I will delete the visits from a given link and day.

Candy jar

On the home page you can draw a candy from the jar. The result shows up right away on the page, in the jar's public statistics and in notifications.

What
Your IP address, needed for draw limits and Turnstile verification. The draw itself (candy, variant, time) goes into the jar's public statistics without any data about you.
Notification
The result is sent to the notification server push.dualfroz.com together with a daily pseudonym: 10 characters of an HMAC-SHA256 hash of your IP address (for IPv6, its first 64 bits), the date and a secret key. The pseudonym changes every day, and without the key it cannot be turned back into an IP address. Its only use is to let notifications group draws by the same person on the same day. Anyone who subscribes to draw notifications, for example in the jar app, can receive them.
Legal basis
Article 6(1)(f) GDPR: running the jar, preventing abuse and sending draw notifications.
How long
The jar statistics keep counters and the 10 latest draws. Your IP address leaves the limit counter when its window ends, after 24 hours at the latest. The notification server deletes messages automatically after 24 hours.

Candy jar app for Android

The app shows the jar statistics, notifies you about draws and announcements and offers home screen widgets. It does not ask for access to your contacts, location, photos, camera or microphone.

What
A random device identifier (32 characters) that the app creates on first launch, the phone's manufacturer and model, the Android version, the app version, and the language and region set on the phone. The server adds the dates the device first and last checked in, and I can give the device a name on my list.
Why
To send an announcement or a message to a specific device and to know which phones and versions the app runs on.
Legal basis
Article 6(1)(f) GDPR: running the app and delivering notifications.
Who sees it
The device list opens only with the jar owner's passphrase. The app connects to dualfroz.com and to the notification server push.dualfroz.com, so both see the phone's IP address.
How long
Messages for a specific device disappear after 7 days, with at most 20 waiting at a time. A device entry stays until I delete it by hand. The list holds 5000 devices; past that number, the ones that checked in longest ago drop off. Uninstalling the app removes the identifier from the phone along with the app's data. You can ask by email to have the entry removed from the server.

Server logs

The web server logs every request to the site, its API and the notification server.

What
IP address, time, requested address, response code and size, referring page (Referer) and browser information (User-Agent).
Why
Security, detecting attacks and abuse, and tracking down bugs.
Legal basis
Article 6(1)(f) GDPR: keeping the site secure and working.
How long
The server starts a new log every day and deletes logs older than 52 days.

Who receives your data

  • Server provider (a VPS in Poland): its machine runs the site, the notification server and the data files described above.
  • Discord Inc. (USA): the tool through which I get notified about contact form messages and referral link use. The data involved is described in Contact form and Referral links.
  • Cloudflare, Inc. (USA): Turnstile verification for the form and the jar, and the cdnjs server that delivers the animation library.
  • Providers of files loaded in your browser: listed in Content from external servers.

I do not sell data to anyone and do not pass it on for advertising.

Transfers outside the European Economic Area

Discord and Cloudflare are based in the USA, so data may leave the EEA. The basis is the European Commission's adequacy decision for companies participating in the EU-US Data Privacy Framework (Article 45 GDPR) and, where that decision does not apply, standard contractual clauses approved by the Commission (Article 46(2)(c) GDPR). The same applies to providers of files loaded in your browser if they serve the request from outside the EEA.

Browser storage

The site stores only the entries below in your browser. There are no analytics or advertising cookies.

lang (cookie)
The site language you picked, pl or en. The server reads it to open the home page and referral links in your language. Valid for a year, renewed on every visit.
dualfroz-tecza, dualfroz-halloween, dualfroz-sesja (localStorage), dualfroz-reflink, dualfroz-reflink-pierwsza (sessionStorage)
The site does not write these. If they are left over from an older version, it deletes them when you visit.

The lang cookie is needed for the site to remember your language. You can delete every entry in your browser settings: the site keeps working, it just forgets the language.

Content from external servers

Your browser fetches some files from other servers. Each of them receives your IP address and browser information, as with any file downloaded from the web.

cdnjs.cloudflare.com (Cloudflare)
The GSAP animation library. On every page.
cdn.jsdelivr.net (jsDelivr)
The animated particle background (tsParticles). On every page, shortly after it loads.
flagcdn.com
The flag on the language switch. On every page.
vulcode.com
The VulCode mark in the footer. On every page.
challenges.cloudflare.com (Cloudflare Turnstile)
Bot verification. On the Contact page, and at the candy jar on the home page once the jar comes into view.
Spotify servers
Track covers: in the music section of the Beyond code page, and in the card with my Discord status on the home page while I am listening to something on Spotify.

Fonts and icons are served from the site's own server, so your browser does not fetch them from Google Fonts or any other service.

The statistics on the Home, About and Open source pages and the Discord status card are fetched by the site's server from ghapi.dualfroz.com, my own statistics service. Your browser does not connect to it and no data about you is passed to it.

Links to social networks, code repositories and project sites are plain links: nothing loads from them until you click. Some candies from the jar open another site in a new tab. Once you are there, that site's rules apply.

Your rights

You have the right to:

  • access your data and get a copy of it (Article 15 GDPR)
  • have inaccurate data corrected (Article 16 GDPR)
  • have your data erased (Article 17 GDPR)
  • restrict processing (Article 18 GDPR)
  • data portability for data I process under a contract, meaning messages about a commission (Article 20 GDPR)
  • object to processing based on legitimate interest (Article 21 GDPR)
  • lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl

To use these rights, write to me@dualfroz.com. Say what it concerns, for example the email address you used in the form or the referral link and the day of the visit, so I can find your data. I will reply within one month at the latest.

Providing data is voluntary. Without a name, subject and message the form will not send, and without an email address I can only reply if you include another way to reach you in the message.

The site does not profile visitors. The only automated decisions are the Turnstile check and the request limits: they can temporarily block sending a message or drawing a candy and have no other effect.

Changes to this policy

Any change to what data the site collects and why is described here, with the effective date at the top updated. The current version is always at this address.