Privacy Policy

This document combines the privacy notice for Bart Rozycki with the basic terms that apply when you use its contact form, subscribe to Engineering Notes, or participate in article discussions.

The website is a personal technology blog and professional portfolio. It does not operate an online store, accept payments, sell digital products, or conclude paid service agreements through the website.

The website and Engineering Notes are operated by Bart Rozycki in an individual capacity.Bart Rozycki is also the controller responsible for determining why and how personal data collected through this website is processed.

The website is available at https://bartrozycki.com(opens in a new tab).

For privacy requests, complaints, newsletter matters, or other questions concerning this document, contact contact@bartrozycki.com.

The website provides the following free functionality:

Access to public website content does not require registration. A valid email address is required only where necessary to send a contact message or subscribe to the newsletter.

Sending an inquiry through the website does not by itself create a paid contract, engagement, employment relationship, or obligation to provide professional services.

To use the website, you need:

You are responsible for the security and configuration of your own device, browser, email account, and GitHub account.

You must not use the website, its forms, or its discussion features to:

Messages or discussion content that violate these rules may be rejected, removed, reported, or blocked. Serious abuse may be reported to the appropriate service provider or authority where reasonably necessary.

By completing the subscription process, you request delivery of Engineering Notes and consent to receiving it electronically at the email address you provide.

To the extent that an issue contains content that may legally qualify as commercial information or direct marketing, your subscription also constitutes your prior consent to receiving that content by email. You may withdraw this consent at any time by unsubscribing.

The contact form allows you to send a private message to the website operator. It may be used for questions about published content, projects, collaboration, speaking, open-source software, or other legitimate inquiries.

Submitting the form does not guarantee a response. The website operator may choose not to respond to spam, automated messages, abusive content, irrelevant solicitations, or requests that would require an unreasonable amount of work.

Contact-form messages are delivered to an email mailbox operated through OVHcloud. Any subsequent email conversation is also handled through that mailbox.

A complaint concerning the contact form, newsletter, or other website functionality may be submitted to contact@bartrozycki.com.

Please describe the problem, the affected functionality, the approximate date on which it occurred, and the outcome you are requesting. Do not include passwords, authentication tokens, private keys, payment details, or other unnecessary sensitive information.

Complaints are reviewed without undue delay and, where reasonably possible, answered within 14 days. Statutory rights and remedies remain unaffected.

The website and newsletter are provided on a best-effort basis. Continuous, uninterrupted, or error-free availability is not guaranteed.

Features may be changed, temporarily suspended, or permanently discontinued for maintenance, security, technical, editorial, legal, or operational reasons.

You may stop using the website at any time. A newsletter subscription may be terminated immediately through the unsubscribe link or by contacting the website operator.

Unless stated otherwise, original articles, text, graphics, branding, and other original website content are protected by copyright and belong to the website operator.

You may link to public pages and quote short excerpts for commentary, research, or reference where permitted by law and accompanied by appropriate attribution. Republishing complete articles, reproducing substantial parts of the website, or using its content to create a competing publication requires prior permission unless applicable law expressly permits the use.

Source code and open-source projects linked from the website are governed by the license displayed in the relevant repository. Those repository licenses take precedence for the covered software.

Articles, code examples, architectural descriptions, and technical opinions are provided for general informational and educational purposes. They do not constitute legal, financial, medical, security, compliance, or other regulated professional advice.

Technology changes over time, and published information may become incomplete or outdated. You are responsible for reviewing, testing, and adapting any information or code before using it in your own systems.

The website may link to external websites, repositories, documentation, social profiles, and third-party services. Those services operate under their own terms and privacy policies.

A link does not imply control over or responsibility for an external service, its availability, security, content, or privacy practices.

Newsletter data is processed to register and verify subscriptions, deliver Engineering Notes, manage subscriber preferences, process unsubscribes, prevent abuse, maintain the subscriber list, and demonstrate that a subscription was requested.

The principal legal basis is your consent under Article 6(1)(a) of the GDPR. Where required, the same affirmative subscription request also records consent to receiving commercial information or direct marketing through electronic communications.

Contact data is processed to deliver, read, assess, and respond to your message. Depending on the nature of the inquiry, processing is based on:

Technical and security data is processed under Article 6(1)(f) of the GDPR for the legitimate interests of operating the website, preventing spam and abuse, diagnosing errors, protecting systems and users, and investigating security incidents.

Where reasonably necessary, limited data may be retained or used to establish, exercise, or defend legal claims, respond to lawful requests, or demonstrate compliance. The legal basis is Article 6(1)(f) or Article 6(1)(c) of the GDPR, depending on the circumstances.

Providing an email address is voluntary, but it is necessary to subscribe to the newsletter. Without it, the newsletter cannot be delivered.

Providing the fields requested by the contact form is voluntary, but the website operator may be unable to receive or respond to an incomplete message.

Do not provide special-category data, identification document numbers, passwords, private keys, authentication tokens, payment information, health information, or other sensitive data unless it is genuinely necessary and you have first agreed on an appropriate method of communication.

Personal data collected through this website is not used to make decisions producing legal or similarly significant effects through solely automated processing.

The website does not create behavioural advertising profiles by default. Optional Google advertising technologies, which may support audience creation and remarketing, are enabled only where you grant Advertising consent and no Global Privacy Control signal is active (see the section on cookies, analytics, and advertising below). Where advertising audience data may constitute sharing for cross-context behavioural advertising, that behaviour is governed by your consent and can be withdrawn at any time.

Automated security systems may classify a request as likely legitimate, automated, or abusive. This is used only to protect forms and infrastructure and does not produce legal or similarly significant effects.

Personal data is shared only where necessary to operate the requested functionality, secure the website, comply with law, or protect legitimate rights.

Providers may use their own subprocessors as described in their contractual and privacy documentation.

Data may also be disclosed to courts, regulators, law-enforcement authorities, professional advisers, or other recipients where required by law or reasonably necessary to protect legal rights.

The website does not sell personal data to data brokers. Where you grant Advertising consent, enabling Google advertising and audience features may involve disclosures to Google that some United States state privacy laws define broadly as a “sale” or “sharing” for cross-context behavioural advertising. This behaviour is optional, is off unless you enable it, is never active while a Global Privacy Control signal is present, and can be withdrawn at any time through “Cookie preferences”. The precise statutory characterization is subject to legal review before the advertising integration is activated.

Some providers, including Beehiiv, Vercel, Cloudflare, GitHub, and — once the optional integration is activated with your consent — Google, are based in the United States or use infrastructure and subprocessors located outside the European Economic Area.

Where personal data is transferred outside the EEA, the transfer is based on an applicable adequacy decision, participation in a recognized data-transfer framework, Standard Contractual Clauses, or another lawful transfer mechanism made available by the relevant provider.

You may contact contact@bartrozycki.com to request further information about the safeguards relevant to your data.

Public discussion content is generally retained on GitHub until it is deleted by its author, removed by a moderator or GitHub, or the relevant discussion or repository is removed. GitHub's own retention rules also apply.

Subject to the conditions and limitations provided by applicable law, you may request:

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Requests may be sent to contact@bartrozycki.com. Reasonable steps may be taken to confirm that a request is made by the person whose data it concerns.

Requests are handled without undue delay and ordinarily within one month. The period may be extended where permitted by law because of the complexity or number of requests.

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the supervisory authority responsible for data protection.

In Poland, the competent authority is the President of the Personal Data Protection Office — Prezes Urzędu Ochrony Danych Osobowych.

You may also contact the supervisory authority in the EEA country in which you live, work, or believe an infringement occurred.

Optional website analytics and advertising technologies are turned off by default. They run only after you make a choice through the “Cookie preferences” interface, and never before. The core website — reading articles, using the contact form, subscribing to the newsletter, and searching — works fully without them, including when JavaScript is disabled or a browser extension blocks analytics.

Essential technical storage or network requests may be used where necessary to deliver a feature you requested, secure a form, remember your privacy choice, or maintain the website's operation. Essential storage is not used for analytics or advertising.

Cloudflare Turnstile is used on protected forms. When the verification is loaded — which happens when you deliberately use a protected form — Cloudflare may process technical signals such as IP address, browser and device information, JavaScript characteristics, request data, and security tokens to detect automated or abusive traffic.

The newsletter signup is implemented as a first-party form that sends data to this website's own endpoint. A Beehiiv signup widget is not embedded in the page, and the Beehiiv integration is server-to-server, so it is not loaded merely by visiting a page. Email open tracking and click tracking are disabled for Engineering Notes.

This website also uses privacy-first, cookieless traffic analytics (Vercel Web Analytics and Cloudflare Web Analytics) to measure aggregate visit counts and page views. These tools set no cookies, use no persistent identifier, and do not track you across other websites, so they run at all times and are not part of the optional consent categories described below.

When Analytics consent is granted, Google Analytics 4 may process:

The integration is designed not to send names, email addresses, contact-form or newsletter fields, comment text, full search queries, or other directly identifying content to Google. Page URLs are sanitized before they are sent: fragments and unknown query parameters are removed and values that look like personal data are rejected. This does not mean analytics data can never constitute personal data; it means the site is built to avoid transmitting the identifying content listed above.

When Advertising consent is granted and the feature is enabled by the operator, the site may link its Google Analytics property to a Google Ads account and support audience and remarketing functionality, advertising cookies and identifiers, and ads personalization according to your Google account settings. These features are enabled only after your Advertising consent and are never active while a Global Privacy Control signal is present. Google Analytics alone does not automatically run an advertising campaign.

The production configuration uses Google Consent Mode v2 in Basic mode. In Basic mode no Google tag is loaded and no request is sent to Google before you consent; no analytics or advertising cookie is created and no cookieless measurement signal is sent until you make a choice. When you consent, the Google tag loads and applies only the categories you accepted. A more permissive Advanced mode exists in the implementation but is not enabled; if it were, Google could send cookieless measurement signals while storage consent is denied. Those signals are not fully anonymous — they may still contain normal network and browser information even when no analytics cookie is created — and enabling Advanced mode requires separate legal review.

Optional categories are disabled by default and are never pre-selected. You can accept all, reject all, or choose Analytics and Advertising separately, and you can reopen your choices at any time using the “Cookie preferences” link in the footer. Withdrawing is as easy as granting: turning a category off updates Google's consent state to denied, stops future collection for that category, and deletes the known first-party Google cookies the site can remove, keeping only the necessary consent-preference cookie. Withdrawing choices on this website affects future collection; it does not by itself erase data Google has already processed. You may exercise applicable data rights as described elsewhere in this policy.

If your browser sends a Global Privacy Control signal, it is honored as an advertising opt-out: Advertising remains disabled, no advertising storage or personalization occurs, and you are not added to remarketing through this site. You can still choose Analytics separately. The preference panel shows a clear status message when the signal is honored. The “Cookie preferences” interface provides the functional equivalent of an advertising opt-out; if a specifically labeled “Do Not Sell or Share My Personal Information” control is later determined to be required, it can reuse this same mechanism.

Google cookie durations are set by Google and stated here as approximate values from Google's documentation and the tag configuration; they may be adjusted. Google cookies are created only after you grant the corresponding consent, and no Google cookie exists before a choice is made.

For visitors in the EEA, the intended legal basis for optional Analytics and Advertising technologies is your explicit consent under Article 6(1)(a) of the GDPR. Necessary storage is handled separately and only where genuinely required. Where Google Analytics is active, the GA4 property's user and event data-retention setting should be intentionally configured — a value such as 14 months is appropriate to keep roughly a year of useful historical reporting — and this policy will state the actual configured value once the integration is activated. This policy does not claim definitive legal compliance and should be reviewed before the integration is enabled in production.

A single privacy-preference system applies to all visitors; there is no separate US banner. Depending on your state of residence and whether a given US state privacy law applies, you may have rights to access, delete, or correct personal information, to opt out of targeted advertising and of the “sale” or “sharing” of personal information, to non-discrimination for exercising your rights, and to have a recognized opt-out preference signal such as Global Privacy Control honored. This website is not necessarily subject to every US state privacy statute, and not all rights apply to every visitor. You can exercise the advertising opt-out at any time through “Cookie preferences”, and Global Privacy Control is honored automatically. Other requests can be sent to contact@bartrozycki.com.

Google is the only optional analytics and advertising provider. Beehiiv still processes operational information needed for newsletter delivery, bounce handling, spam complaints, subscription management, and unsubscribe requests, but it is not loaded by visiting a page and is therefore not governed by the cookie-consent categories above.

Article discussions are provided through Giscus and GitHub Discussions. The discussion component is loaded only after you actively choose to load it.

If you do not load the discussion component, the article page does not intentionally load the GitHub discussion iframe.

When you load or use the discussion feature, your browser connects to GitHub and Giscus. GitHub may process technical data and account information under its own privacy statement and terms.

Comments are public. Do not post private correspondence, confidential information, personal data about other people, credentials, security vulnerabilities, or information that you do not have the right to publish.

Discussion content may be moderated or removed in accordance with the discussion guidelines, these terms, and GitHub's rules.

The newsletter or website may occasionally invite readers to provide feedback about an article, project, or open-source tool.

A private message, newsletter reply, or contact-form submission is not treated as permission to publish or attribute the feedback.

Private feedback will not be publicly quoted, associated with your name, associated with your employer, or presented as a testimonial without your separate and explicit permission for the proposed use.

Public comments posted through GitHub Discussions are public by their nature and may be displayed alongside the relevant article.

Reasonable technical and organizational measures are used to protect personal data, including encrypted HTTPS connections, restricted access to provider accounts, form validation, rate limiting, anti-abuse verification, and reputable hosting and email providers.

No method of internet transmission or electronic storage can guarantee absolute security. You should not send credentials, secrets, private keys, or highly sensitive information through the contact form.

The website and newsletter are intended for a general professional and technical audience and are not specifically directed at children.

The website operator does not knowingly request personal data from children. A parent or guardian who believes that a child has submitted personal data may contact contact@bartrozycki.com.

This document may be updated when the website, newsletter, legal requirements, or service providers change.

The current version is always available on this page, together with the last-updated date. Material changes affecting active newsletter subscribers may also be communicated by email where appropriate.

The website is operated from Poland. These terms are governed by Polish law, subject to any mandatory rights that apply to you under consumer, privacy, or other applicable law.

Nothing in these terms limits rights that cannot legally be excluded or restricted.