What I collect

This one page covers pozar.se, monocultured.com, hintlab.org, matepo.se and the shop. banray.eu has its own policy.

The short version

No advertising. Nothing sold, shared or handed to anyone. No following you from one of my sites to the next. I keep a small amount of information about how the sites are used, on a server I own, so I can tell whether the things I make are being read at all.

This page says exactly what that is. If a sentence here is vague, treat it as a mistake and tell me.

If your browser says no

If your browser sends a Do Not Track signal, the analytics record nothing at all. Not a page view, not anything. You do not have to take my word for that: open your browser's developer tools, watch the network tab, and you will see no request leave your machine.

Global Privacy Control is a different signal, and the analytics software I use does not act on it. If you use Firefox with Enhanced Tracking Protection set to Strict, GPC is the signal your browser sends, and it will not stop the counting.

What the analytics record

I run Umami on my own server. Nothing goes to Google or any other company, and it sets no cookies. For each visit it stores:

• the page address, the path only. Anything after a ? or a # is removed in your browser and never sent
• the site you arrived from, if any
• an approximate location worked out from your IP address: country, region and city
• your browser, operating system, device type, screen size and language
• a visit identifier: a one-way hash of your IP address and browser, so that six page loads count as one visit rather than six. The IP address itself is never stored in the analytics, and the identifier changes regularly

The path-only rule matters more than it sounds. It means the tracking identifiers other companies staple onto shared links, like Facebook's fbclid and Google's gclid, never reach my server at all, even when someone shares a link that carries one.

Taken together this is not anonymous, and I will not call it that. Browser, operating system, screen size, language and city are specific enough to pick one person out of a crowd. It is coarse, it is not attached to your name, and it never leaves my server, but it is not truly anonymous.

There is no retention period. The analytics go back to 26 March 2026 and nothing deletes them.

Cookies

Most of the time there are none. Nothing here sets a cookie to recognise you, and there is no cookie banner because there is nothing to consent to.

Three things do set one, and only once you use them:

• putting something in the basket on hintlab.org, which stores what is in the basket so the shop can read it. It disappears when you close your browser
• filling in one of the surveys at pozar.se/surveys/, which sets an ordinary PHP session cookie. That is what stops someone else submitting the form in your name
• the relationship form at monocultured.com/relationship/, which does the same

None of them identify you, none are used for advertising, and nobody else can read them. You can check this yourself: open developer tools and look at the cookie list.

Two other things are kept by your browser and never sent anywhere: whether you chose light or dark mode, and, on monocultured.com, what is in your basket.

One page can produce cookies that are not mine at all. If you press play on one of the embedded videos described further down, YouTube sets its own at that moment. Those are Google's, and that page is the only place on any of my sites where a third party can set one.

Server logs

Separately from the analytics, the web server keeps a standard access log of every request: IP address, time, the address requested, and the browser string. This happens for everything I host, and no browser setting or blocker changes it, because it is the server writing down that a request arrived rather than anything running in your browser.

These logs are deleted after 14 days. I use them to investigate faults and abuse, and nothing else.

The newsletter

If you subscribe I store your email address and which list you are on, using Listmonk on my own server. You confirm by email before anything is sent, and every issue carries a one-click unsubscribe that works immediately and permanently.

I do not track whether you open an issue or click a link in it. There is no tracking pixel in the templates, and not one open or click has ever been recorded. Your IP address is not stored when you sign up.

The shop

To send you an order I need your name, address and email, and I keep a record of what you ordered. If you give a VAT number it is checked against the EU's VIES service.

I also store the IP address the order was placed from. That one is a legal requirement rather than a choice: EU rules on digital services want evidence of which country a customer was in.

Payment is handled entirely by Stripe. Card details are entered on Stripe's own systems and never touch my server, so I never see them and could not store them if I tried. Stripe sets its own cookies on its own pages and has its own privacy policy.

Order records are the one thing I cannot delete on request. Swedish bookkeeping law requires accounting material to be kept for seven years, and a completed sale is accounting material. Anything that is not part of that record I will delete if you ask.

Writing to me

What you type into a contact form is emailed to me and sits in my mailbox like any other email. It is not written to a database, not added to any mailing list, and not used for anything else. If the mail fails to send, the failure is logged, which means the error message and not your message.

The surveys

If you fill in one of the surveys at pozar.se/surveys/, your answers are stored in a database on my server. Where a survey asks for a name, an email address or your availability, that is so I can contact you about taking part, and it is only ever used for that.

Each submission also stores a scrambled form of your IP address. It is there to spot the same person submitting twenty times, and nothing else. The scrambling is done with a secret key that never leaves my server, on both surveys, so the result cannot be worked backwards into the address it came from.

Sending and receiving files

send.hintlab.org is a small file-sharing service I run for passing files to people without email attachments. Files put there are stored on my server until they expire or are deleted, and anyone holding the link can fetch them, so treat a link as the key. Fetching one is an ordinary web request and appears in the server log described above.

It has no analytics on it and nothing about it is shared with anyone.

The app

Gifoludek, the Mac app I give away in beta, does not connect to anything. It has no analytics and no telemetry, and the build you can download today has no networking code in it at all, so it could not send anything anywhere even if I wanted it to. Whatever you open, edit and export stays on your Mac.

Version 1 will add one optional feature that talks to my server: a check for updates, switched off unless you turn it on. All it asks is whether a newer version exists, and it sends nothing about you, your files, or how you use the app. It is not in the beta you can download today, and I will update this page when it ships.

Downloading it from this site is an ordinary web request, so it appears in the server log described above, exactly like any other download.

Who else gets any of this

Nothing collected here is sold, shared or handed to an advertiser. Only two outside parties ever receive anything: Stripe, when you buy something, and the EU's VIES service, if you give a VAT number.

There is one exception and you should know about it. The junior researcher case study on pozar.se has twelve videos embedded from YouTube. They use YouTube's no-cookie mode, so nothing is set on your machine unless you actually press play, but simply loading that page contacts Google's servers and tells them your IP address and which page you are looking at. If that bothers you, do not open that page. I would rather host those videos myself and have not got round to it: video streaming eats bandwidth and I need to work out how.

Apart from those embeds there are no third-party scripts on any page, no fonts loaded from anyone else's server, and no advertising network anywhere.

Asking me

Write to mateusz@pozar.se and ask what I hold about you, or ask me to delete it. Given how little there is, the honest answer will usually be that there is nothing tied to you to find. The exceptions are the newsletter, if you subscribed, a shop order, which I have to keep for seven years, and a survey you filled in with your contact details.

Every statement on this page was checked against the running servers on 23 August 2026 by an LLM and proofread by me personally.