Privacy Policy

Controller

The controller for the processing described on this page is:

Alden Pike

Email: [email protected]

Everything on this page is the responsibility of the controller named above: the processing described below, the legal basis given for each part of it, and the rights set out further down. If you need the controller’s details in a form that block does not give you — for a request under those rights, or for a complaint to a supervisory authority — ask at [email protected] and they will be provided.

Scope

This policy covers elephantphp.com. Sites linked from an article have their own controllers and their own policies, and following a link takes you outside the scope of this page.

Server logs

The site is static and is served by Cloudflare. Delivering a page to you means Cloudflare receives and records your IP address, your browser’s user agent string, the URL requested, and the timestamp of the request. That data is what makes it possible to return the page at all, and what makes it possible to tell ordinary traffic apart from an attack.

Legal basis: legitimate interests, Art. 6(1)(f) GDPR. The interest is operating the site and defending it from abuse — denial-of-service traffic, automated scraping, probing for vulnerabilities. The balancing test comes out this way because the data is used only to deliver and protect the site: it is not combined into a profile, not used to target anything at you, and not passed on for anyone else’s purposes.

Retention: Cloudflare’s own operational retention for log and security data. The site does not set that period. There is no application server behind this site and no separate log of its own.

Cookies and local storage

This site sets no cookies. The one thing it stores on your device is the color theme you picked, held in localStorage and read back on the next page so the theme survives the navigation. It holds no identifier, and no request on this site sends it anywhere.

No consent banner is shown, and that is a decision rather than an oversight. ePrivacy Art. 5(3) requires consent to store information on your device or to access information already stored there, except where the storage or the access is strictly necessary to provide a service you explicitly requested. Storing the theme you chose by hand is that exemption, and it is the only storage this site performs. The reasoning is set out in full on the Cookie Policy page.

Newsletter

The newsletter is optional and nothing happens with your address unless you ask for it.

What is collected: your email address, plus the subscription and confirmation timestamps recorded by Buttondown, the service that runs the list.

Legal basis: consent, Art. 6(1)(a) GDPR. Consent is given by ticking a checkbox beside the subscription form. The box is never pre-ticked, and the form cannot be submitted without it.

Double opt-in: submitting the form sends one email asking you to confirm. No address receives the newsletter before the confirmation link in that email is clicked, and an address that is never confirmed receives nothing further.

Withdrawing consent: every email carries a one-click unsubscribe link. Withdrawing is as easy as subscribing was, takes effect immediately, and does not affect the lawfulness of anything sent before you withdrew.

Processor: Buttondown acts as a processor under Art. 28 GDPR. It stores the subscriber list and sends the mail on instruction, and does not use the addresses for its own purposes.

Retention: your address is held for as long as you stay subscribed. On unsubscribe it is removed from the subscriber list and kept on a suppression list, which exists for one reason — to make sure a later import cannot mail you again — and which holds the address and nothing else. If you would rather it were erased outright, ask at [email protected] and it will be.

International transfer: Buttondown is established in the United States, so subscribing transfers your address outside the EEA. The safeguard relied on is the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, as offered in Buttondown’s data processing agreement. That agreement is being confirmed; if the safeguard in force turns out to be Buttondown’s certification under the EU–US Data Privacy Framework instead, this section is corrected to name it.

What this site does not do

There is no advertising and no ad network. There is no profiling, no behavioral targeting, and no automated decision-making of the kind Art. 22 GDPR governs. No personal data is sold, rented, or shared for anyone else’s marketing. The pages themselves load no third-party embeds at all: no video players, no social widgets, no comment system, no fonts fetched from someone else’s domain. Nothing on this site is built to recognize you between visits.

Your rights

Under the GDPR you have the right to:

• Access (Art. 15) — ask whether personal data about you is processed, and receive a copy of it.
• Rectification (Art. 16) — have inaccurate data corrected.
• Erasure (Art. 17) — have data deleted.
• Restriction (Art. 18) — have processing limited while a dispute over it is resolved.
• Portability (Art. 20) — receive data you provided in a structured, machine-readable format, where the processing rests on consent or a contract.
• Objection (Art. 21) — object to processing based on legitimate interests, on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7(3)) — withdraw newsletter consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of them, email [email protected]. A response follows within one month of the request, as Art. 12(3) GDPR requires; if a request is complex the period can be extended, and you are told inside that first month if it is.

Complaints

If you consider the processing described here to breach the GDPR, you can lodge a complaint with a supervisory authority. Art. 77 gives you the choice of the authority in the EU member state where you live, where you work, or where the alleged infringement took place. Raising it at [email protected] first is welcome, but nothing obliges you to do that before complaining.

Changes to this policy

When this policy changes in a material way, the date shown at the top of this page changes with it. A change that describes new processing is published before that processing starts, not after.