Privacy policy

1. Legal notice (Spanish LSSI-CE art. 10)

Owner: José Manuel Ortega de la Calle · Contact: [email protected] · You can also use the form at www.josemanuelortega.dev

This blog is a personal project with no commercial activity. It is provided «as is», without express or implied warranties. The Spanish version of this policy is the authoritative one for legal purposes.

2. Personal data collected on the blog

This site collects personal data only through two opt-in mechanisms: the comment form and the newsletter subscription form. If you don't fill either of them in voluntarily, no personal data is stored.

When you submit a comment, the following data is stored on the server:

• Name: published next to the comment exactly as you write it. You may use a pseudonym.
• Email: kept for 90 days from submission and then automatically erased from the server. Never published nor shared. Its sole purpose is to allow moderation of the comment.
• Email hash: a cryptographic hash of the email derived with an internal salt. Its purpose is technical and functional, it powers the geometric avatar that accompanies each comment so that the same person always sees the same avatar, even months between comments. It also makes impersonation harder, since a different email would yield a different avatar. The hash contains no personal data in cleartext and cannot be reversed to recover the original email.
• Comment content: published exactly as you write it (after manual moderation). Any links are marked as user-generated content (rel="ugc nofollow").
• Hashed IP: when you submit a comment, a hash of your IP is generated with an internal salt to apply anti-abuse limits (3 comments every 10 minutes). The raw IP is never stored nor logged persistently.

Comments are held pre-publication until manually approved. Those flagged as spam or removed by moderation are deleted from the database.

3. Newsletter

Subscribing to the newsletter is voluntary. You only receive emails if you sign up yourself in the form and confirm the double opt-in that arrives in your inbox.

Data processed when you sign up:

• Email: required to send you the newsletter.
• IP address and user agent: stored at sign-up as proof of consent (GDPR art. 7.1). When you unsubscribe, they are deleted immediately.
• Version of the consent text accepted: so you can know at any time exactly what you accepted at sign-up.
• Sign-up, confirmation and unsubscribe dates for auditing purposes.

Purpose: send the blog newsletter (notes on QA, tools and reflections, roughly bi-weekly).

Legal basis: your explicit consent when ticking the form checkbox and completing the double opt-in (GDPR art. 6.1.a).

Delivery processor: emails are delivered through Resend Inc. (United States), acting as data processor. The transfer relies on Standard Contractual Clauses (SCCs) approved by the European Commission, under GDPR art. 46.2.c. Resend processes the emails in its Ireland region. Its privacy policy and DPA are available at resend.com/legal.

No tracking:the newsletter emails contain no open pixel and don't rewrite links. Resend also doesn't track opens or clicks on this service (disabled at the account level).

Retention periods:

• If you don't complete confirmation, your address is automatically deleted after 30 days.
• If you confirm, your data is kept while your subscription is active.
• After you unsubscribe, IP and user agent are deleted immediately. The unsubscribe record itself is kept for up to 90 days and then deleted entirely.

How to unsubscribe:every email includes a one-click unsubscribe link at the bottom. We also honour Gmail/Outlook's native «Unsubscribe» button (List-Unsubscribe header).

4. Cookies and local storage

This site exclusively uses strictly-necessary storage technologies needed for the site to function:

• localStorage — theme preference: stores whether you selected light or dark mode. No personal data; persists in your browser until you clear it manually.
• localStorage — cookie notice:records that you have read this notice so it isn't shown again. No personal data.
• localStorage — legal disclaimer:on certain articles a legal disclaimer is shown before the content. When accepted, it's stored in your browser for 7 days to avoid showing it again. No personal data.
• localStorage — anonymous reactions identifier: when you interact with the reaction buttons of an article, a random identifier (UUID) is generated and stored in your browser. It isn't linked to any personal data and its only purpose is to prevent duplicate reactions. You can remove it by clearing site data in your browser.
• localStorage — commenter details: if you submit a comment, your name and email are stored in your browser (key blog-commenter) so they can be pre-filled next time. They don't leave your device. You can remove them by clearing site data in your browser.
• Cookie NEXT_LOCALE— language preference: when you first visit the blog, a small client-side script detects whether your system is in English and, if so, sends you to the /en version. Your final choice is stored in this cookie (SameSite=Lax, 1-year lifetime) so the next visit respects your language without re-running detection. It contains no personal data and is used only to route content.
• Cookie i18n-nudge-dismissed— translation banner: if a translated post shows an «available in the other language» banner and you dismiss it, this cookie remembers the dismissal so it doesn't appear again (SameSite=Lax, 1 year). It contains no personal data.
• Session cookie (admin only):used solely in the admin panel to keep the blog editor's session. Public visitors never receive this cookie.

No analytics, advertising, tracking or third-party cookies of any kind are used.

5. Purpose and legal basis for the remaining processing

Technical storage (localStorage, session cookie) is used for the site to function and for anti-abuse anonymisation. Legal basis: the controller's legitimate interest (GDPR art. 6.1.f) and the consent exemption for strictly necessary cookies (Spanish LSSI-CE art. 22.2).

Data from the comment form (name, email, content) is processed based on the visitor's unambiguous consentwhen clicking «Send» (GDPR art. 6.1.a). It's used only to moderate and publish the comment. Email is minimised by proportionality (GDPR art. 5.1.c) and deleted after 90 days.

6. Web analytics

This site uses Umami, a self-hosted, open-source web-analytics tool hosted on the same server as the blog (located in France, European Union). Umami doesn't use cookies, doesn't store IP addresses (they are anonymised via hashing), and doesn't share data with third parties. The information collected is limited to pages visited, referrer, browser, operating system and country, all aggregated and anonymous. Data doesn't leave the European Economic Area.

7. Third-party services

Apart from the analytics described and the newsletter delivery processor (Resend Inc., see section 3), this site doesn't integrate external services that collect visitor data. No advertising networks, tracking pixels or social-media widgets that load third-party content. Fonts are served directly from this server.

8. International transfers

The blog server and the Umami instance are physically located in France (European Union). Newsletter data is additionally transferred to Resend Inc. (United States) under Standard Contractual Clauses (SCCs) approved by the European Commission. Resend processes the emails in its Ireland region. No other transfers outside the European Economic Area are made.

9. Your rights

Under the GDPR (articles 15-22) and the Spanish LOPDGDD, you have the right to access, rectify, erase, restrict or object to the processing of your data, as well as to data portability and withdrawal of consent at any time.

To exercise any of these rights, write to [email protected] from the affected email address or from one that lets me identify you. For the newsletter specifically, the unsubscribe button at the bottom of every email has the same effect as withdrawing your consent.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, since that is the supervisory authority for the controller.

10. Changes

This policy may be updated to reflect changes in how the site operates. The current version will always be available from the link in the footer and at /en/privacidad. The Spanish version at /privacidad is the legally authoritative one.