Privacy
What this site knows about you
Short, because there is not much of it. No advertising, no data sales, no third-party tracking pixels.
Who is responsible
Piotr Knapik publishes Open Req Letter in a personal capacity and is the data controller for this site. Contact: piotr@openreqletter.com.
Postal address: ul. Mickiewicza 8/5, 59-800 Lubań, Poland. The letter is published in a personal capacity, not through a registered business.
The newsletter
If you subscribe, your email address is stored so the letter can be sent to you. That is the only field required. The legal basis is your consent, Art. 6(1)(a) GDPR, given by submitting the form and confirming the address.
The letter is sent through an external email platform, which processes your address on my instructions under a data processing agreement. The platform records whether a message was delivered, opened, and whether links in it were clicked. This is used to judge whether an issue was worth writing, not to build a profile of you.
Every issue carries an unsubscribe link. One click removes you, and the address is deleted from the active list. The archive on this site stays open either way. Nothing here is gated.
Before launch: set NEWSLETTER.provider in src/config/site.ts. This paragraph then names the platform, its country of processing and its DPA by itself.
The contact form
What you type into the contact form reaches one inbox. It is not added to the newsletter list, and it is not used for anything other than replying to you. The legal basis is legitimate interest, Art. 6(1)(f) GDPR: answering someone who wrote to me. Correspondence is kept while it is useful and deleted when it is not.
That inbox runs on Google Workspace (Google Ireland Limited), which stores the message so it can be read and answered. Google may transfer data to the United States under the Standard Contractual Clauses and the EU-US Data Privacy Framework.
Analytics
Traffic is measured with a privacy-preserving analytics tool that sets no cookies, stores no personal data, and does not track you between websites or sessions. It records aggregate counts: pages viewed, referring site, country, and device type. Because no personal data is stored and no cookies are set, there is no consent banner on this site. There is nothing to consent to.
If that ever changes, and a tool is added that sets cookies or identifies visitors, a consent banner will appear before it loads, and this page will say so.
Cookies
This site sets no cookies of its own. It stores nothing in your browser except what your browser caches to load the pages faster.
Hosting
The site is served as static files by Cloudflare Pages (Cloudflare, Inc., with Cloudflare Ireland Ltd as its EU establishment), which keeps standard server logs (IP address, timestamp, requested file, user agent) for security and abuse prevention. Request logs are kept for a short period under Cloudflare’s own retention policy and are not combined with anything else on this site. Their own policy is at cloudflare.com/privacypolicy.
Fonts and external requests
Fonts are served from this site's own domain, not from Google Fonts. Loading a page here sends no request to a third-party server. That is a deliberate choice: embedding Google Fonts has been found to transmit visitors' IP addresses to a third country without a legal basis.
Your rights
Under the GDPR you can ask me to:
- tell you what data I hold about you, and give you a copy;
- correct it if it is wrong;
- delete it;
- restrict or object to how it is used;
- withdraw consent to the newsletter at any time, without affecting past sends.
Write to piotr@openreqletter.com and you will get an answer within a month, normally within a week. If you think the law has been broken you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
Changes
If this page changes in substance, the date at the top changes with it and the next issue of the letter says what moved.