Privacy policy

This policy explains which personal data thomasmoserdev.com processes when you visit it, why, and what your rights are. The site has no user accounts, no newsletter and no advertising, and it sets no cookies of its own.

Who is responsible

Thomas Moser, a private individual who publishes this site (see the legal notice), is the controller of the data described here. Contact: thomas-moser@orange.fr.

What is processed, and why

Hosting

The site is hosted by Vercel. Like any web server, it receives the technical data needed to deliver pages and protect the service: your IP address, the page requested, the date and time, your browser's user agent and the referring page. Vercel keeps these logs only for operation and security, under its own policy; the site keeps no request logs of its own. Legal basis: legitimate interest in running a secure website (Article 6(1)(f) GDPR).

Audience statistics

Page views are counted with Vercel Web Analytics, which uses no cookies and stores no IP address. Each view records the page, the referring site, your country or region (derived from your IP address), your browser, operating system and device type. Visitors are told apart by a hash of the request that Vercel discards after 24 hours, so views can't be linked to a person or followed across sites. Legal basis: legitimate interest in knowing which pages are read.

Blog view counts

When you open a post, your browser tells the site which post you are reading, and the post's view counter goes up by one. To count each reader once a day, the site stores, for 24 hours, a one-way hash of a random daily key, your IP address and the post. Your IP address itself is never stored, and the random keys are deleted after 48 hours, after which the hashes can no longer be linked to anyone. The counters are plain numbers per post. These data are stored with Upstash, the site's database provider, in its European region. Legal basis: legitimate interest in showing honest view counts.

Home page visits by country

Each visit to the home page adds one to a daily counter for your country, which Vercel derives from your IP address. Only the country and the count are stored, for 7 days.

Comments

Comments under posts use giscus, which displays a GitHub Discussion of this site's repository. The comments frame is loaded from giscus.app only when you scroll down to it; like any website, giscus.app and GitHub then receive your IP address and browser information. Reading comments needs no account. To comment or react, you sign in with GitHub: your comment is published on GitHub under your GitHub account, under GitHub's privacy statement, and giscus keeps a sign-in token in your browser's storage for giscus.app. You can edit or delete your comments on GitHub at any time. Legal basis: legitimate interest in showing the discussion; posting is your own choice.

Images and activity widgets

Project screenshots, album covers and game images are served through the site's own image service, so your browser does not contact Cloudinary, Deezer or Steam. The listening and gaming activity on the activities page is Thomas Moser's own, fetched by the server; nothing about you is sent to Deezer or Steam.

Contacting me

The site has no contact form. Emails you send me, and messages through WhatsApp, LinkedIn or Calendly, are used only to answer you and are kept only as long as the conversation needs. Legal basis: legitimate interest in answering messages. Those services process your messages under their own privacy policies.

Cookies and local storage

The site sets no cookies and stores nothing in your browser for its own purposes, so there is no cookie banner. The only browser storage involved is giscus's sign-in token, and only if you sign in to comment.

Recipients and transfers outside the EU

The data above are processed by Vercel Inc. (hosting and statistics, United States), Upstash (database, hosted in the EU by a United States company), and GitHub, Inc. and giscus (comments, United States). The site's fonts, images, videos and 3D scene are all served from the site itself. Transfers to the United States rely on the EU-U.S. Data Privacy Framework where the company is certified (Vercel and GitHub are), and otherwise on the European Commission's standard contractual clauses. Nothing is sold or shared for advertising, and no profiling or automated decision-making takes place.

Your rights

You can ask for access to, correction or deletion of your data, restrict or object to its processing, and ask for a copy in a portable format, by writing to thomas-moser@orange.fr. Most data described here can't be linked to you (daily hashes, counters, aggregated statistics), so there may be nothing to find. Comments are managed directly on GitHub. You can also lodge a complaint with the French data protection authority, the CNIL.

Changes

This policy describes the site as it is. When the site changes how it handles data, the policy is updated and the date at the top changes.