Privacy Policy

This page explains what personal data bapspatil.com collects, why, and what you can do about it.

Who is responsible

This site is operated by Bapusaheb Patil, trading as Nuits, a Finnish sole trader (toiminimi), Business ID 3584845-8, based in Helsinki, Finland. Nuits is the data controller for the processing described here.

There is no published street address and no separate data protection officer. All privacy questions go to hi@bapspatil.com.

The short version

If you do nothing, this site collects nothing about you beyond what is technically required to deliver a web page. Analytics only start after you press “accept” in the cookie banner, and they stop again if you reject.

Hosting and server logs

The site runs on Cloudflare Workers, so every request passes through Cloudflare’s network before it reaches the site. To route, serve and protect the request, Cloudflare processes connection metadata such as your IP address, the requested URL, your browser’s user agent and the time of the request. This happens for every visitor and cannot be switched off, because without it the page cannot be delivered at all. The legal basis is legitimate interest in running and securing the site.

Cloudflare acts as a processor for this site under its own data processing terms.

Cookies and local storage

Before you answer the cookie banner, the site stores nothing on your device. When you answer it, your choice is saved in your browser’s local storage under the key cookie-consent, with the value analytics-accepted or analytics-rejected. That entry exists so the banner stops asking. It contains no identifier and is never sent to a server.

If you accept, the analytics script is loaded. It sets no cookies and writes no identifier of its own. If you reject, one further local storage entry, umami.disabled, is written to keep the script switched off. Clearing your browser storage removes these entries.

Analytics, only after consent

Analytics is Umami, which I self-host at umami.nuits.net. The script is not downloaded at all until you accept, so before that nothing is transmitted and nothing is loaded from the analytics domain.

Umami sets no cookies, stores no identifier in your browser, and does not follow you to any other site. It works out whether two requests belong to the same visit by hashing the site, your IP address and your browser’s user agent together with a salt that is rotated daily. That hash cannot be reversed into an IP address, and it stops being linkable to you when the salt rotates.

Once you accept, the following is collected:

Page views. The page you are on, the page you came from, your screen size, your browser and operating system, your language, and a country and region derived from your IP address. The IP address itself is not stored.

A small set of named events. Clicks on calls to action, social links and outbound links; project card clicks; filters applied on the work page; language switches; an interaction on the contact section; shop and recognition link clicks; and the start and end of the small game on the home page, including the score reached. The search box on the work page reports the number of characters you typed and the number of results returned. It does not report the text of your query.

There is no session recording, no heatmap, no automatic error reporting and no capture of anything you type. No name, email address or account is attached to any of it, because the site does not ask you for one.

Because the analytics instance runs on my own infrastructure rather than a third party’s, the data is not shared with an analytics vendor at all.

The legal basis is your consent. You can withdraw it at any time by rejecting in the cookie banner or by clearing this site’s local storage. Withdrawal stops future collection; it does not undo events already recorded.

The high-score table

The home page has a small game. When you finish a run, your score is sent to this site and stored in a database hosted by Turso, together with the time and the IP address the request came from. The IP address is stored for abuse prevention: it is also used as a short-lived rate-limit key held for sixty seconds in Cloudflare KV, so that one visitor cannot flood the table with fake scores.

No name, email address or nickname is stored with a score. The table only ever displays a single number, the highest score anyone has reached. The legal basis is legitimate interest in keeping a public endpoint from being abused.

Accounts

The site includes the Better Auth library with a database on Turso, which defines tables for users, sessions and linked accounts. No sign-up and no login is offered to visitors, so ordinary browsing does not create a user record. If a signed-in area is ever added, this policy will be updated before it goes live.

Contacting me

You can reach me by email at hi@bapspatil.com or by booking a call through the Cal.com link on the site. Anything you write in an email is stored in my mailbox for as long as it is useful to have it. Bookings are handled by Cal.com, which collects whatever you enter in its form and processes it under its own privacy policy.

Retention

Analytics events are kept in the self-hosted Umami database and are not kept indefinitely. High scores are kept until the table is reset. Rate-limit keys expire after sixty seconds. Cloudflare’s logs follow Cloudflare’s own retention. Email is kept as long as the conversation is relevant.

Who else sees your data

Cloudflare (hosting and network), Turso (database), and Cal.com (bookings, only if you book). Analytics is self-hosted, so no analytics provider receives your data. Nothing is sold, rented, or handed to advertisers. There are no advertising networks, no social media pixels and no third-party trackers on this site.

Where data leaves the EU or EEA, it is transferred under the standard contractual clauses or another safeguard provided by the service in question.

Your rights

Under the GDPR you can ask to access your data, to have it corrected, to have it erased, to restrict how it is processed, to receive it in a portable format, and to object to processing based on legitimate interest. You can also withdraw consent for analytics at any time.

Send any of these requests to hi@bapspatil.com. Bear in mind that most of what is collected here is not linked to your name, so I may need more information to identify your data, and in some cases I will not be able to identify it at all.

If you think something is wrong, you can complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

Children

This site is not aimed at children and does not knowingly collect data from them.

Changes

The date at the top of this page is the date of the last change. Material changes will be reflected here rather than announced individually.

Language

This policy is written and maintained in English. Translated versions of this site may show the same English text or a translation of it. If the versions differ in meaning, the English version prevails.

Questions about any of this go to hi@bapspatil.com.