Skip to content
◆nivobi.comv27.09
cat privacy.md

Privacy

Last updated 2026-10-01 · data controller: Nicolai Lehner Birk, Aarhus, DK

This site is a personal portfolio. It collects as little as possible, uses no third-party advertising or tracking, and sets no tracking cookies. This notice explains what I collect, why I'm allowed to, how long I keep it, where it lives, and the rights you have under the GDPR.

# Who is responsible

The data controller for this site is Nicolai Lehner Birk, based in Aarhus, Denmark. For anything in this notice, or to use any of your rights, email hello@nivobi.com.

# Analytics

Pageviews are counted by a small first-party script that sends the page path and the referring URL to my own server. Along with that I store your country (looked up by my hosting provider from your IP), whether you're on a desktop or mobile browser, and a one-way hash of your IP used to de-duplicate visits. The raw IP is not stored.

  • · No cookies, no fingerprinting, no cross-site tracking.
  • · Browsers sending Do Not Track are excluded entirely.
  • · Bots, crawlers, and headless browsers are left out of the stats.
  • · Data stays in my own database. Never sold or shared.

Legal basis: legitimate interest (GDPR Art. 6(1)(f)), to understand how the site is used and keep it working. The data is minimised and cookieless, so the impact on you is low. Retention: individual pageview rows are deleted automatically after 14 months.

# Contact form

If you use the contact form, the details you enter (name, email, what it's about, and your message) are stored so I can read and reply. To keep spam out I also store a one-way hash of your IP and your browser's user-agent string. It's used for that purpose only and is not shared with anyone.

Legal basis: your consent when you choose to send the message, and steps taken at your request before any possible engagement (GDPR Art. 6(1)(a) and (b)). Retention: kept while we're in contact and for up to 12 months after our last exchange, then deleted. Ask me by email any time and I'll delete them sooner.

# Snake leaderboard

If you submit a score, the handle you choose and your score are stored and shown publicly on the leaderboard. A one-way hash of your IP and your browser's user-agent string are stored with it (not shown) to limit cheating and abuse. Don't put personal information in your handle.

Legal basis: your consent when you submit a score (GDPR Art. 6(1)(a)). Retention: kept until you ask me to remove your entry or I retire the leaderboard.

# Dev log reactions

If you react to a blog post, the reaction is stored with a one-way hash of your IP, so each visitor counts once. Legal basis: legitimate interest (GDPR Art. 6(1)(f)), to keep the counts honest. Retention: kept as long as the post is online, or until you ask me to remove it.

# Trackable QR links

Plain QR codes are made entirely in your browser and nothing is sent to me. If you choose a trackable link, I store the target URL, the label you give it, and a one-way hash of your IP (to limit abuse). Anyone with your private management link can see and edit it.

When someone scans a trackable code, I record the time, device type, operating system, browser, language, and country, plus a hash that changes every day so a scan can be counted as unique for that day but can't be linked across days. No IP address is stored.

Legal basis: for link creators, providing the service you asked for (GDPR Art. 6(1)(b)); for people who scan, legitimate interest in basic, non-identifying scan stats (Art. 6(1)(f)). Retention: individual scans are deleted after 90 days (only the total count is kept). Links stay until you delete them, which also deletes their scans.

# Local storage

Your chosen color theme, and whether you've accepted the QR link guidelines, are saved in your browser's local storage so the site remembers them. They never leave your device, are not personal data I receive, and are not used for tracking, so no cookie-consent banner is needed. Clearing your browser storage removes them.

# Hosting and where your data lives

Two companies host the site for me and act as my data processors:

  • · Vercel Inc. serves the site and runs its server code in Frankfurt, Germany. Like any web host it keeps short-lived technical logs, including IP addresses, to run and secure the service.
  • · Supabase Inc. runs the database and image storage in Frankfurt, Germany.

Your data is stored inside the EU. Both companies are based in the USA, so their staff or systems may access it from there. Those transfers are covered by their data processing agreements, which include the EU Standard Contractual Clauses. I don't use any third-party advertising, analytics, or tracking services, and fonts and scripts are served from this site, not from outside CDNs.

# Your rights

Under the GDPR you have the right to:

  • · Access the data I hold about you and get a copy.
  • · Rectify data that is wrong or incomplete.
  • · Erase your data ("right to be forgotten").
  • · Restrict or object to how I process it.
  • · Portability: receive your data in a common, machine-readable format.
  • · Withdraw consent at any time, where processing is based on consent.

To use any of these, email hello@nivobi.com and I'll handle it, normally within 30 days.

# Complaints

If you think I've handled your data wrongly, please email me first so I can put it right. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, at datatilsynet.dk.

# Changes to this notice

If I change how the site handles data, I'll update this page and the "last updated" date at the top. The current version always lives here.

← back to home