What this site measures, and what it doesn't.
This is a four-page portfolio. There are no accounts, no forms, no comments and no advertising. The only thing measured is which pages get read — with a self-hosted, cookieless counter I run myself on my own infrastructure. This page says exactly what that involves, because the GDPR requires it whether or not a consent banner does.
Who is responsible.
Julian Kramer, Amsterdam, the Netherlands — the controller for the processing described here. Questions, objections and requests: info@kardz.eu.
Umami, self-hosted, no cookies.
What is collected
Every page carries one small script from analytics.kardz.eu. Per page view it records the page address, the referring address if you arrived from a link, your country, your browser and operating system, your screen size and the time. That is the whole list.
Your IP address
Your IP address is used to derive your country and a one-way hash that separates one visitor from another for the rest of the day. The IP address itself is not stored, and the hash is regenerated daily — so nothing links today's visits to yesterday's, and nothing resolves back to you. An IP address is still personal data while it is being processed, which is why this page exists.
No cookies, no profiling
Nothing is written to your browser: no cookies, no local storage, no fingerprinting, no cross-site identifier. There is no advertising network, no remarketing, no A/B testing and no profiling. Because nothing is stored on your device, no consent banner is required under the Dutch Telecommunications Act — the notice is required regardless, and this is it.
Who else sees it
Nobody. Umami is open-source software running on infrastructure I own and operate; the statistics are not shared with, sold to, or processed by any third party, and they never leave the EU. There is no Google Analytics, no Meta pixel and no third-party tag manager on this site.
The one other place data appears.
The site is served by Azure Static Web Apps (Microsoft, EU region). Like any web server, it processes the IP address of each request in order to answer it, and keeps short-lived operational logs. I do not use those logs for analytics and do not combine them with anything above. Microsoft acts as a processor under its standard data protection terms.
Why it is allowed, and how long it lasts.
Legal basis
Legitimate interest — article 6(1)(f) GDPR — in knowing which pages of my own portfolio are read, measured with the least intrusive tool I could pick: no cookies, no third party, no identifier that outlives the day.
Retention
Individual page-view records are kept for at most 24 months and are then deleted; only anonymous totals remain. Because the visitor hash is regenerated every day, a record older than a day cannot be tied to any other record in any case.
What you can ask for.
You have the right to access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interest. Mail info@kardz.eu and I will answer personally. Be aware that the analytics data holds no identifier that resolves to you, so I usually cannot locate "your" records — the honest remedy for that is the objection right, which I will honour by excluding you going forward. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
Prefer to send nothing at all? Any content blocker, or a browser with Do Not Track or tracker blocking on, stops the analytics request. The site works identically without it — the same is true of console.js, the ⌘K command console, which runs entirely in your browser and sends nothing anywhere.