Privacy Notice

Last updated: 23 June 2026

I keep this site lean and I treat your data the same way. No advertising, no third-party trackers, no selling data. This notice explains who is responsible for your data, what is collected, why, the legal basis for each use, how long it is kept, where it is processed, and the rights you have.

Who is responsible

The controller for the data described here is Bob Belderbos. You can contact me at bob@belderbos.dev.

Analytics

I run my own analytics (checkpulse, self-hosted). For each page view, and for certain named actions such as a "book a call" click, it stores one record containing:

  • the page path, with query strings and fragments removed
  • the referring site's domain only, not the full URL (visits from within this site are not recorded as referrals)
  • a coarse browser family and device type, for example Chrome on desktop, from your browser's user-agent
  • a timestamp
  • a daily visitor hash (described below)

The daily visitor hash is produced from your IP address, your user-agent, and a random salt, using a one-way function. Your IP address is used only to compute this hash and for short-term, in-memory rate limiting; it is never stored or logged. The salt is held in memory and rotates every day and on restart. Within a day, the records from one visitor share the same hash, which is how unique visits are counted.

Nothing is stored on or read from your device: no cookies, no localStorage, no fingerprinting. Because the analytics store nothing on your device, no consent banner is required. Requests that send a Do Not Track signal are dropped, and automated (bot) traffic is not recorded.

This processing involves personal data. Your IP address is personal data; it is processed in memory to compute the hash and is never stored. While that day's salt is live, the stored records are pseudonymous personal data: the visitor hash can single out one visitor and link their page views and actions within that day. Once the salt rotates and is discarded, the hash can no longer be linked to a visitor or recreated, and the records become non-identifying. The dashboard shows only aggregated counts.

Legal basis: legitimate interests (Article 6(1)(f)). The interest is understanding aggregate site usage in order to maintain and improve the site.

Newsletter

If you subscribe, your email address is stored by Buttondown, which sends the newsletter on my behalf as my processor. Subscription requires email confirmation (double opt-in). I use it only to send the newsletter.

Legal basis: consent (Article 6(1)(a)). You can withdraw consent at any time using the unsubscribe link in any email. Withdrawal removes you from the list and does not affect processing carried out before it.

Booking a call

If you book a call, scheduling is handled by Calendly as my processor. The details you enter (such as your name and email) are used to set up the meeting.

Legal basis: performance of a contract, including steps taken at your request before entering one (Article 6(1)(b)).

Coaching engagements

If you engage me for coaching — 1:1 work, a structured program, a cohort, or a team engagement — I process the personal data needed to assess, agree, and deliver that work. Depending on the engagement, this includes:

  • your name, email, and any other contact details you give me
  • your intake questionnaire and what you tell me about your goals, your experience, your project or app idea, your availability, and what is holding you back
  • our correspondence and my notes and feedback from our calls and code reviews
  • the code and repositories you share for review on GitHub, which I access to review and comment on
  • the billing details needed to invoice you and take payment, handled through Holded, my invoicing provider

Scheduling is handled by Calendly, as described under Booking a call. For cohorts and team engagements, group communication takes place on Slack, the work is often co-run with another coach, and the program may run on a separate platform with its own privacy notice.

Legal basis: performance of a contract, including steps taken at your request before entering one, such as the intake questionnaire and proposal (Article 6(1)(b)); compliance with a legal obligation for invoices and accounting records (Article 6(1)(c)); and, where I publish a short testimonial that names your first name and role, your consent (Article 6(1)(a)), which you can withdraw at any time.

Hosting and security

The site runs on Cloudflare Pages, and the analytics backend (checkpulse) runs on Fly.io. To deliver the site, route requests, and protect it from abuse, these providers process request metadata including your IP address. checkpulse itself does not store your IP, as described under Analytics. See Cloudflare's privacy policy and Fly.io's privacy statement.

Legal basis: legitimate interests (Article 6(1)(f)) — delivering the site reliably and protecting it from abuse.

Where your data is processed

Buttondown, Calendly, Cloudflare, Fly.io, GitHub, and Slack are based in the United States, so using them transfers personal data outside the EEA and UK. The safeguards are:

  • Cloudflare, Calendly, Fly.io, GitHub, and Slack are certified under the EU-US Data Privacy Framework (including its UK and Swiss extensions), and use the EU Standard Contractual Clauses as a contractual fallback.
  • Buttondown processes subscriber data in the United States under a data processing agreement that gives EU, UK, and Swiss data protection law priority over US law.

Holded, which handles invoicing, is based in Spain and stores data in the EU, so no transfer outside the EEA takes place.

How long I keep your data

  • Analytics: your IP address is never stored. Each record carries the daily visitor hash; once that day's salt rotates, the hash can no longer be linked to a visitor, so the retained records are non-identifying. Records are kept as aggregate statistics.
  • Newsletter: your email address is kept until you unsubscribe or ask me to remove it.
  • Booking: I keep the details only as long as needed to arrange and follow up on the call; Calendly retains data under its own notice.
  • Coaching: I keep engagement records — your intake, our correspondence, and my notes and feedback — for the duration of our work and for a reasonable period afterwards; invoices and accounting records are kept for the period required by applicable tax law.

Your rights

If your personal data is processed, you can: access it; have it corrected or erased; restrict or object to its processing; receive it in a portable form (for data processed on the basis of consent or contract); and withdraw consent at any time where processing relies on consent.

These rights apply in full to your newsletter, booking, and coaching data, which are linked to your identity. For the analytics data they are limited: I retain no IP address or other identifier that I can tie to you, so I cannot locate the analytics records relating to a specific person, and I am not required to collect additional data solely to do so (Article 11 GDPR). If you can supply information that enables identification I will act on it; for the analytics data this is generally not possible.

You can also lodge a complaint with a data protection supervisory authority, generally the one in your country of residence or work.

To exercise any of these, email me at bob@belderbos.dev.