Privacy Policy

1. Cloudflare Web Analytics (Edge Telemetry & Core Web Vitals)

We deploy Cloudflare Web Analytics, a privacy-first measurement platform provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare Web Analytics is engineered specifically to measure site health and performance indicators without impinging upon end-user privacy.

• • Cookie-less Execution: Cloudflare Web Analytics does not set, read, or store persistent cookies, local storage entries, or session storage records on client devices.
• • Zero Cross-Site Fingerprinting: The platform does not calculate canvas hashes, audio fingerprints, or hardware signatures to track individuals across distinct domains or digital identities.
• • Telemetry Harvested: Metrics captured comprise Core Web Vitals (Largest Contentful Paint [LCP], Cumulative Layout Shift [CLS], Interaction to Next Paint [INP]), Time to First Byte (TTFB), page render intervals, HTTP referrer headers, device platform, browser user agent strings, and coarse regional geolocation.
• • Ephemeral IP Processing: IP addresses are inspected transiently within volatile edge server RAM solely to determine country-level routing and are immediately discarded without persistent disk serialization.
• • Further Information: For exhaustive architectural specifications, consult the Cloudflare Privacy Policy (https://www.cloudflare.com/privacypolicy/) and Cloudflare Web Analytics documentation (https://www.cloudflare.com/web-analytics/).

2. Google Analytics 4 & Off-Thread Partytown Execution

We utilize Google Analytics 4 (GA4), an event-driven web analytics suite administered by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; for EEA residents, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). GA4 measures aggregate visitor engagement and operational interface telemetry.

• • Worker Thread Isolation: To safeguard main-thread responsiveness, preserve 0ms Total Blocking Time (TBT), and protect page load velocity, the Google Analytics client runtime is decoupled from the browser main execution thread and isolated within an off-thread background Web Worker via Partytown.
• • IP Masking & Anonymization: In Google Analytics 4, IP anonymization is active by default. Full IP strings are not serialized to disk; rather, incoming IP addresses are momentarily processed at regional ingestion endpoints to infer coarse geographic parameters (city/metro level) and are subsequently purged before telemetry is committed to permanent datastores.
• • Identifiers & Attributes: GA4 relies upon pseudonymous alphanumeric client identifiers (e.g., _ga) to distinguish distinct sessions, record page interaction events (astro:page-load triggers, scroll milestones, and outbound link navigation), screen dimensions, and language preferences.
• • Cross-Border Safeguards: Data ingested by Google may be transferred to and archived on servers within the United States pursuant to the EU-U.S. Data Privacy Framework (DPF) and European Commission Standard Contractual Clauses (SCCs).
• • Opt-Out Mechanisms: Visitors may indefinitely preclude Google Analytics from capturing interaction signals across all web destinations by deploying the official Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).

3. Google Tag Manager (GTM Infrastructure & Container Orchestration)

We deploy Google Tag Manager (GTM) infrastructure, operated by Google LLC, as a stateless container delivery system to provision measurement libraries (specifically via https://www.googletagmanager.com/gtag/js).

• • Stateless Delivery: Google Tag Manager acts exclusively as a content distribution mechanism and script orchestrator. GTM itself does not instantiate tracking profiles, does not write distinct advertising cookies, and does not record personal behavioral data in an autonomous capacity.
• • Transmission Headers: When requesting tag configurations from Google content delivery networks, the client browser inherently transmits network connection headers, including the outbound IP address and HTTP User-Agent. These headers are processed purely to service the cryptographic payload delivery request from the nearest edge node.
• • Privacy Governance: All tracking directives orchestrated through container definitions are strictly governed by the overarching Google Privacy & Terms disclosure (https://policies.google.com/privacy).

4. Microsoft Clarity (Behavioral Analytics, Heatmaps & Session Replay)

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement (https://privacy.microsoft.com/en-us/privacystatement).

• • Behavioral Metrics Ingested: Clarity records cursor coordinate vectors, click velocity, scrolling depth, dynamic document layout shifts (CLS telemetry), navigation timelines between internal pages, time-on-page intervals, JavaScript errors, and hardware viewport dimensions.
• • Mandatory Client-Side Masking: Strict automated content masking is programmatically enforced in the browser DOM prior to any recording serialization. All input text fields, form elements, sensitive alphanumeric patterns, and personally identifiable text strings are redacted into obfuscated masks before telemetry leaves the client sandbox.
• • Tracking Technologies Employed: Microsoft Clarity deploys first-party cookies (e.g., _clck and _clsk) alongside third-party identifiers to stitch disparate web page transitions into coherent interaction sessions across page routing events.
• • Opt-Out & Privacy Controls: Visitors can manage their interest-based advertising preferences and data collection settings via the Microsoft Privacy Dashboard (https://account.microsoft.com/privacy) or through cross-industry opt-out portals such as the Digital Advertising Alliance (DAA) WebChoices Tool (https://optout.aboutads.info/) and the Network Advertising Initiative (NAI) Consumer Opt-Out (https://optout.networkadvertising.org/).

Legitimate Interests (Art. 6(1)(f) GDPR)

Processing is necessary for the purposes of legitimate interests pursued by the Data Controller, specifically:

• • Guaranteeing infrastructure integrity, network resilience, DDoS mitigation, and edge firewall defense against automated attack vectors.
• • Diagnosing software anomalies, script exceptions, layout regressions, and performance bottlenecks across heterogeneous browsers and operating environments.
• • Auditing technical content resonance, reader engagement patterns, and optimizing interface usability through aggregated behavioral telemetry.

Consent & Electronic Privacy Directives (Art. 6(1)(a) GDPR)

Where local statutory mandates (such as the EU ePrivacy Directive 2002/58/EC as amended) require prior consent for the deposition and retrieval of non-essential persistent cookies or behavioral identifiers, such processing is subject to affirmative user consent signals, browser configuration choices, and revocable consent preferences.

Global Privacy Control (GPC) & Do Not Track (DNT)

Our edge infrastructure and client runtime support client-side privacy signals. When our platform detects an active Global Privacy Control signal (navigator.globalPrivacyControl === true) or Do Not Track header (navigator.doNotTrack === "1"), we treat such signals as an explicit request to restrict non-essential behavioral profiling and analytics aggregation.

Native Browser Storage & Cookie Disabling

You may configure your browser software to reject all third-party cookies, clear existing cache artifacts, block cross-site tracking scripts, or alert you when cookies are dispatched. Consult the configuration documentation for your respective browser engine (Google Chrome, Mozilla Firefox, Apple Safari, or Microsoft Edge). Please note that disabling browser storage mechanisms may alter cosmetic preference persistence, such as your selected dark/light visual theme.

Retention Timeframes

Operational retention windows are enforced per processor category:

• • Google Analytics 4: User-level and event-level exploratory records are configured with an automated expiration cycle of two (2) months to fourteen (14) months, after which aggregated records are systematically purged.
• • Microsoft Clarity: Session replay recordings and raw behavioral interaction sequences are retained on Microsoft cloud infrastructure for a maximum rolling window of thirty (30) to ninety (90) days pursuant to standard Clarity data lifecycles.
• • Cloudflare Web Analytics: Aggregated performance metrics are preserved for historical trend inspection, with raw IP-derived request streams discarded instantaneously at the edge edge runtime.

Transborder Data Flows

Due to the globally distributed architecture of Cloudflare Pages edge networks, Google cloud clusters, and Microsoft infrastructure, collected telemetry may be transmitted to, stored in, and processed within jurisdictions outside your country of residence, including the United States. International transfers originating from the European Economic Area (EEA), United Kingdom, or Switzerland rely upon European Commission Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements (IDTAs), and commercial adequacy frameworks including the EU-U.S. Data Privacy Framework.