---
title: "Privacy"
url: "https://florea.xyz/privacy/"
date: "2026-11-09T17:25:12+02:00"
updated: "2026-11-09T17:25:12+02:00"
author: "Bogdan Florea"
---

# Privacy

## Who runs this site

Bogdan Florea runs florea.xyz.

Contact: [bogdan@florea.xyz](mailto:bogdan@florea.xyz). This is the same address as in [security.txt](/.well-known/security.txt).

## Reading the site

The site sets no cookies for visitors, and has no analytics, no ads and no trackers. Fonts are served from florea.xyz.

Some posts show photos hotlinked from Unsplash (images.unsplash.com), as Unsplash's terms require. Your browser fetches those images from Unsplash, which sees your IP address.

Your browser's local storage holds two small items. They never leave your device.

- `florea.reactions`: which comments you reacted to
- `florea.shortcuts`: whether you turned keyboard shortcuts off

## Where it runs, logs and backups

The site, its logs, backups and mail are all in Romania.

### Hosting

The site runs on Kicked SRL infrastructure in Romania.

### Web server logs

- Each request is logged with your IP address, the time, the page requested, the referrer and your browser's User-Agent. These logs are kept for about 5 weeks.
- Requests that look like attacks are also sent to the operator's security monitoring, and addresses that attack the server are blocked.

### Backups

- A nightly encrypted backup of the database and the site's files goes to a backup server in Romania. There is no copy outside Romania.
- Backups are kept indefinitely. If you ask for deletion, your data is deleted from the live site. It stays only inside those encrypted backups, which are never used for anything else. If a backup is ever restored, the deletion is applied again.

### Outgoing mail

- Mail is sent from a mail server in Romania, straight to your mail provider.
- The site keeps no copy of the messages it sends.
- The mail log (sender, recipient, time, receiving server) is kept for about 5 weeks.

## Comments

What is stored:

- your name and your comment
- the time
- your email address, which is never shown and never sent to Gravatar or anyone else
- a shortened IP address, with the last part removed (/24 for IPv4, /48 for IPv6)

Your browser's User-Agent is not stored.

Every comment is held until it is approved.

Spam is deleted after 30 days. Deleted comments are removed for good after 30 days.

Why: to show the discussion and to keep spam out. The legal basis is legitimate interest, GDPR Art. 6(1)(f).

## Reply emails

You get reply emails only if you tick the box and confirm the link sent to you. The legal basis is consent, GDPR Art. 6(1)(a).

- Every reply email has a one-click unsubscribe.
- The site stores whether you subscribed, confirmed or unsubscribed, and when you confirmed.
- Outgoing mail waits in a queue until it is sent, usually within a minute. A message that can't be delivered is deleted after 7 days.

## Anti-abuse records

Rate limits and reaction counting use a one-way hash of your network address. The hash changes every day.

- Rate-limit records are deleted within about 2 days, reaction records within about 3 days.
- Reaction counts are anonymous.

## Your rights

You can ask for a copy of your data, a correction, or deletion of your comments and subscriptions. Email [bogdan@florea.xyz](mailto:bogdan@florea.xyz).

You can complain to the Romanian data protection authority, ANSPDCP ([dataprotection.ro](https://www.dataprotection.ro)).

## Changes

This page is updated when the site adds features, such as a newsletter, stats or video embeds. The date of the last update is shown at the top of the page.