Privacy policy
Esta página ainda não está disponível no seu idioma, então aparece em inglês.
This Privacy Policy explains what personal data is processed when you use smartapple.co, its language versions and its installable web app (together, the "Site"), why, and what your rights are.
smartapple.co is a personal website. It is written and run by a private individual, not by a company. I have designed it to collect as little personal data as possible. There are no public user accounts, no comments, no newsletter, no advertising and no cross-site tracking, and the Site uses no cookies for analytics.
1. Who is responsible for your data
The controller of your personal data is:
The private individual who runs this personal website Email: a direct message on Instagram
Write to a direct message on Instagram for any privacy question or to exercise your rights. I have not appointed a Data Protection Officer, because the law does not require one for a site like this.
Why the GDPR applies to a personal website. The GDPR does not apply to purely personal or household activities. A website that anyone on the internet can open is not purely personal, so the GDPR, Romanian Law no. 190/2018 and Romanian Law no. 506/2004 on privacy in electronic communications apply to the Site in full, and you have all the rights described below.
2. Summary
| What | Is personal data processed? | Legal basis |
|---|---|---|
| Reading the Site | Yes, briefly: technical data needed to deliver pages (such as your IP address) | Legitimate interest |
| Audience measurement (the Site's own analytics) | Yes, pseudonymised and minimised. Your IP address is never stored. Nothing is stored on your device | Legitimate interest, with opt-out |
| Push notifications | Yes, only if you turn them on | Consent |
| Motion effect (tilting your phone) | No. Sensor data never leaves your device | Not applicable |
| Posts from other sites (Instagram, YouTube and similar) | Only if you click to load them, and then by that site | Consent (click to load) |
| Writing to me by email | Yes | Legitimate interest |
| Admin accounts (me and anyone I invite to help edit) | Yes | Legitimate interest |
3. What is processed, why, and on what legal basis
3.1 Delivering the Site (hosting, content delivery and security)
The Site is hosted by Vercel Inc. (United States). Its server functions run in Vercel's EU region in Frankfurt, Germany. Pages, images and videos are delivered through Vercel's global content delivery network, so a request may be answered by the Vercel server closest to you, which can be outside the EU. Images and videos are stored on Vercel Blob, Vercel's file storage service. The database (stories, settings, push subscriptions, analytics events and admin accounts) is a PostgreSQL database run by Neon in an EU region.
When you visit the Site, your browser sends technical data to Vercel so that pages and videos can be delivered to you.
Data: IP address, date and time of the request, page or file requested, HTTP status, amount of data sent, referrer, browser user agent (browser, version, operating system), and similar technical data.
Purposes: delivering the Site, keeping it secure and available, preventing abuse (for example bot attacks), and fixing errors.
Legal basis: my legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).
Retention: Vercel keeps request and runtime logs only for the short period set by the hosting plan, and then deletes them. The Site's own code does not write IP addresses to these logs.
3.2 Audience measurement (the Site's own analytics)
The Site has its own small analytics system, so I can see which stories people read and how to make them better. It does not use Google Analytics or any third-party analytics or advertising service. It does not track you across other websites, builds no advertising profiles, and no data is sold. It sets no cookies and stores nothing on your device.
What is recorded (events):
| Event data | Details |
|---|---|
| Page views and time on page | Page address, language version, story, date and time, and a short signal every so often while the page is open, to estimate reading time |
| Scroll depth | How far down a page you scrolled |
| Video plays | Which slide or video was played |
| Share clicks | Which share option you used (the share itself happens in the other app) |
| Site search | Only that a search happened and how many results it gave. The words you type are not stored |
| Other actions | Sound switched on or off, intro played or skipped, language changed, link to another site clicked, app installed, notification clicked |
| Referrer | Only the domain of the website or app that sent you (for example "instagram.com"), and a campaign tag ("utm_source") if the link had one |
| Approximate location | Country and city, as estimated by the hosting provider from your IP address at the moment of the request |
| Device and browser | Device type (mobile, tablet, desktop), operating system, browser, and whether you opened the Site as an installed app |
How visitors are counted without storing your IP address: for each event, a one-way code (a SHA-256 hash) is computed from your IP address, your browser's user agent and a secret value that changes every day at midnight UTC. Only this code is stored, never your IP address. Because the secret value changes every day, the code is different every day: I can count how many different visitors came on one day, but I do not follow anyone from one day to the next. Events with the same code and less than 30 minutes between them count as one visit.
Purpose: to measure audience, see which content is useful, improve the Site and spot technical problems.
Legal basis: my legitimate interest in understanding and improving my publication (Article 6(1)(f) GDPR). I have weighed this against your rights and limited the data accordingly: no IP storage, nothing stored on your device, no cross-site tracking, no profiling for advertising, codes that change daily.
Your right to object (opt-out): the Site honours the Global Privacy Control signal and the Do Not Track setting of your browser. If your browser sends either of them, no analytics events are recorded at all. You can also object at any time by writing to a direct message on Instagram.
Retention:
- raw events: 90 days, then deleted;
- before deletion, events are added up into daily totals per page (views, visitors, shares, average reading time and scroll depth). These totals do not identify anyone, are not personal data and are kept indefinitely.
Where it is stored: in the Site's database at Neon, in the EU (see section 3.1). Automated traffic that can be recognised (search engine crawlers and other bots) is not counted.
3.3 Push notifications
If you install the Site as a web app (on iPhone and iPad this needs "Add to Home Screen") or use a supported browser, you can choose to receive notifications about new stories. Nothing happens until you turn notifications on in the Site; your browser then asks you for permission.
Data stored after you turn notifications on:
- the push subscription created by your browser: an endpoint address at your browser's push service, and the encryption keys needed to send you messages;
- your language and any topics you choose;
- your platform (installed app on iPhone or iPad, Android, or desktop) and your browser's user agent string, so notifications display correctly on your device;
- when you subscribed, when the subscription was last used, and how many deliveries failed;
- whether you clicked a notification (as an analytics event, see section 3.2).
Your name, email address or phone number are never received.
Purpose: to send you the notifications you asked for, in your language, and to see whether they are useful.
Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of Law no. 506/2004).
Withdrawing consent: turn notifications off on the Site, turn off notifications for the Site in your browser or device settings, or remove the installed app. This does not affect processing before you withdrew.
Push services: notifications are delivered through the push service of your browser or device maker: Apple (Apple Push Notification service), Google (Firebase Cloud Messaging, used by Chrome and many Android browsers), Mozilla (Firefox) or Microsoft (Edge). The message content is encrypted between the Site and your browser. The push service sees technical data such as the endpoint and delivery times, under its own terms. Some of these providers are outside the EEA (see section 6).
Retention: while your subscription is active, it is used to send you notifications. When you turn notifications off, or when the push service reports that the subscription has expired, sending stops at once and the subscription is deactivated. It is not deleted automatically: the deactivated record, with the endpoint and keys, is kept until you ask me to erase it or until I remove it. A deactivated subscription is never used to send anything. To have it erased, write to a direct message on Instagram.
3.4 Motion effect (tilting your phone)
On phones and tablets, the collage moves slightly when you tilt your device. This uses the motion sensors through your browser. The readings are used only inside your browser to move the pictures; they are never sent to me or anyone else, and never stored. Where your browser asks for permission (for example on iPhone and iPad), the effect works only if you allow it. The Site does not use your camera or microphone.
3.5 Posts from other sites (Instagram, YouTube and similar)
Some stories show posts or videos from other services, such as Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland), YouTube (Google Ireland Limited) or others. To protect your privacy, they are not loaded automatically. You first see a preview image served by the Site. The post loads from the other service only when you click it, and you are asked again on every page.
When a post loads, your browser connects directly to that service. It can receive your IP address, browser information and the page you are on, can link the visit to your account if you are logged in, and may set or read its own cookies.
Legal basis: your consent, given by clicking to load the post (Article 6(1)(a) GDPR and Article 4(5) of Law no. 506/2004). For the moment of loading, the Site and that service may be joint controllers (CJEU judgment C-40/17, Fashion ID); everything the service does afterwards is its own responsibility under its own privacy policy (for Instagram: https://privacycenter.instagram.com/policy).
3.6 Fonts
The Site uses the fonts Instrument Serif, Hanken Grotesk and Geist Mono. They are not loaded from Google when you visit: the Site uses Next.js's font system (next/font), which downloads them once when the Site is built and then serves them from smartapple.co. Your browser does not contact Google Fonts.
3.7 Share previews and share buttons
When someone shares a link to the Site, apps such as WhatsApp, Instagram, Facebook, LinkedIn or X show a preview (title, image and description) built from public information on the page. Those apps fetch the preview from the Site; this involves no personal data about you.
The share buttons are plain links or your device's share menu. They load no script from social networks and send them nothing until you click. Once you click, you are on the other service and its privacy policy applies. The Site records that a share option was used (section 3.2), but not what you shared or with whom.
3.8 Writing to me
If you write to me (to report an error, make a privacy request, or ask about using my content), I process your name, email address, your message and anything you choose to send.
Purpose: to answer you, handle corrections and keep a record of requests.
Legal basis: my legitimate interest in replying and in keeping the content accurate (Article 6(1)(f) GDPR); for privacy requests, the legal obligation to answer them (Article 6(1)(c) GDPR).
Retention: correspondence for 24 months after the matter is closed; records of privacy requests for 3 years, to show they were answered.
Emails are handled by my email provider, which processes them on my behalf.
3.9 Admin accounts
Only I, and anyone I invite to help me edit, can log in to the Site's admin area. The public cannot create accounts.
Data: name, email address, role, password (stored only as a secure hash), login times and login attempts, the IP address and browser of each login session, and a log of changes made in the admin area (who published, edited or deleted a story, and when).
The admin area can also be connected to an AI assistant (Claude, by Anthropic) that helps me edit stories. The connection uses secure tokens that only I can authorise and revoke.
Purposes: giving editors access, protecting the admin area (including limiting repeated failed logins), keeping a record of editorial changes, and investigating incidents.
Legal basis: my legitimate interest in security and in keeping a record of editorial changes (Article 6(1)(f) GDPR).
Retention: account data while the account is active, then deleted within 90 days. Login sessions expire after 30 days. Security logs: 12 months. Change log: as long as the content is published, plus 3 years.
4. Children
The Site is a general information publication and is not aimed at children under 16. I do not knowingly collect personal data from children under 16. Push notifications should only be turned on by people aged 16 or over, or with the consent of a parent or guardian (Article 8 GDPR). If you believe a child has given personal data through the Site, write to me and it will be deleted.
5. Who receives your data
Your personal data is never sold and never shared with advertisers.
These service providers ("processors") process data only on my instructions, under data processing terms in line with Article 28 GDPR:
| Recipient | Role | Data | Location |
|---|---|---|---|
| Vercel Inc., United States | Hosting, server functions, content delivery network, security, file storage (Vercel Blob) | Technical request data, logs, approximate location used by the analytics | Functions in the EU (Frankfurt); delivery network worldwide |
| Neon (Neon, Inc., part of Databricks, Inc.), United States | PostgreSQL database | Analytics events, push subscriptions, admin accounts, change log | EU region |
| Anthropic (Claude) | AI assistant used by me in the admin area | Story content and the admin data I choose to work on through it | United States |
| My email provider | Correspondence | As set out in the provider's terms |
These receive data as independent controllers (they decide how they use it):
| Recipient | When | Data |
|---|---|---|
| Browser push services (Apple, Google, Mozilla, Microsoft) | When you turn on and receive notifications | Push endpoint, delivery data, encrypted messages |
| Instagram (Meta), YouTube (Google) and other services whose posts appear in stories | Only when you click to load a post | See section 3.5 |
Data may also be disclosed to public authorities, courts or professional advisers where the law requires it, or where it is needed to establish, exercise or defend legal claims.
6. Transfers outside the European Economic Area
Vercel, Neon and Anthropic are United States companies, Vercel's delivery network serves requests from servers around the world, and some push services are run by United States companies. Where personal data goes outside the EEA, the transfer is protected by one of the safeguards in Chapter V GDPR: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses, with extra measures where needed.
You can ask for a copy of the relevant safeguards at a direct message on Instagram.
7. Retention summary
| Data | Retention |
|---|---|
| Hosting and security logs (Vercel) | The short period set by the hosting plan |
| Your IP address in the analytics | Never stored |
| Analytics raw events | 90 days |
| Aggregated daily statistics | Indefinitely (not personal data) |
| Active push subscriptions | Until you turn notifications off or the subscription expires |
| Cancelled or expired push subscriptions | Deactivated and never used again; kept until you ask for erasure or I remove them |
| Motion sensor data | Never stored or sent |
| Your language, sound and intro choices (in your browser) | See the Cookies and Local Storage Notice |
| Correspondence | 24 months after the matter is closed |
| Records of privacy requests | 3 years |
| Admin accounts | While active, then deleted within 90 days |
| Admin login sessions | 30 days |
| Admin security logs | 12 months |
| Editorial change log | While the content is published, plus 3 years |
Data may be kept longer only if the law requires it or if it is needed for a legal claim, and only for as long as necessary.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy (Article 15);
- rectify inaccurate data (Article 16);
- erase your data in certain cases (Article 17);
- restrict processing in certain cases (Article 18);
- data portability, for data you gave on the basis of consent (Article 20);
- object at any time to processing based on legitimate interest, including analytics (Article 21);
- withdraw your consent at any time, without affecting earlier processing (Article 7(3)).
To exercise your rights, write to a direct message on Instagram. I will reply within one month; for complex requests this can be extended by two further months, and I will tell you if so. I may ask for information to confirm your identity.
Because the Site deliberately avoids identifying data (IP addresses are never kept and visitor codes change every day), I will usually not be able to find analytics records about you. If so, I will tell you (Article 11 GDPR). For push notifications, turning them off stops all sending at once; to have the deactivated subscription erased as well, write to a direct message on Instagram.
Right to lodge a complaint
You can complain to a data protection supervisory authority. In Romania, this is:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 Bucharest, Romania Website: www.dataprotection.ro Email: anspdcp@dataprotection.ro
You can also complain to the authority in the EU country where you live or work, or where you think an infringement took place. I would be grateful for the chance to sort out your concern first.
9. Automated decision-making
No decisions about you are made solely by automated processing, including profiling, with legal or similarly significant effects (Article 22 GDPR).
10. Do you have to give any data?
No. You can read the Site without giving anything beyond the technical data that every browser sends to load a website. Push notifications and posts from other sites are optional, and you can switch off the analytics with Global Privacy Control or Do Not Track.
11. Security
The Site uses appropriate technical and organisational measures, including:
- encrypted connections (HTTPS, with HSTS) everywhere;
- no storage of IP addresses in the analytics, daily changing visitor codes, and as little data as possible;
- encrypted push messages between the Site and your browser;
- an admin area open only to people I authorise, with hashed passwords, limits on repeated failed logins, HttpOnly session cookies and a change log.
No system is completely secure. If a personal data breach is likely to put you at risk, I will notify the supervisory authority and, where required, you (Articles 33 and 34 GDPR).
12. Changes to this policy
If the Site or the law changes, I will update this policy before any new kind of processing starts, publish the new version here with a new date and, for significant changes, show a notice on the Site.
Last updated: 16 October 2026