$ cat privacy.md
Privacy
What www.baltavista.com collects, where it keeps it and for how long. Last updated 3 November 2026.
Who is responsible
This site is run by Barış Akın. For any question about your data, or to have it deleted, write to barisakin@gmail.com.
When you read the site
- Server and Cloudflare. The site runs on a server in Germany, and its traffic passes through Cloudflare, which handles your IP address and browser details to deliver the pages and to keep attacks away.
- Server logs. For every request, the web server (nginx) records the time, the address asked for, the page you came from and your browser's description. The address it sees is Cloudflare's server, not yours. The logs are deleted after 14 days.
- View counts. Each time a post is read, the site stores which post, the date and time, and the site you came from (its name only). A reader is counted once per post every half hour; for that, your IP address and the post are kept in memory for 30 minutes and then forgotten. To count how many different people read the blog, a short digest of your IP address, made with a secret salt that never leaves the server, updates a HyperLogLog counter. Neither the address nor the digest is stored: the counter is only 16,384 small numbers, and the count it gives is an estimate (under 1% off).
- Google Analytics. Only if you accept it in the bar at the bottom of the page, the site loads Google Analytics (GA4), which shows how many people visit and which posts they read. Google then sets its own cookies (
_ga,_ga_*) and processes your IP address and browser details. If you decline, or do not answer, nothing is loaded from Google for it. - Downloads. Downloading a file appears in the server logs like any other request.
When you comment
- Sign-in. Commenting needs a Google sign-in. Google's sign-in script is loaded only when you scroll down to the comments, so a reader who does not loads nothing from Google for it.
- What is kept. From Google: your name, email address and account ID. From you: the comment, when you wrote it and when you last edited it, and the IP address it was written and last edited from.
- What is shown. Your name, your comment and its date. Your email address, account ID and IP address are never shown on the site; only the admin sees them, to deal with abuse.
- Session. After you sign in, the site keeps you signed in for 30 days with a cookie of its own (
blog_c). Signing out ends it. - Editing and deleting. You can edit or delete your own comments at any time. A deleted comment with no replies is removed entirely. One that has replies stays as "This comment was deleted" so the replies keep their place; its text, email address and IP addresses are removed, your name and account ID stay but are not shown.
- Limits. To stop floods, the IP address of a sign-in attempt is kept in memory for 10 minutes and the number of your comments for 10 minutes, then forgotten.
Cookies and browser storage
| Name | What for | How long |
|---|---|---|
lang | the language you picked with the switcher | 1 year |
blog_c | your comment session, only after you sign in | 30 days |
_ga, _ga_* | Google Analytics, only if you accept | up to 2 years |
ga-consent | your answer to the cookie bar, in your browser's local storage, never sent | until you clear it |
blog-theme | light or dark theme, in your browser's local storage, never sent | until you clear it |
Who else sees it
Nothing is sold or passed on for advertising. The data above reaches only the services the site is built on: Cloudflare (delivery), Google (Analytics and sign-in) and the server's hosting company in Germany.
Your rights
Under the GDPR and Turkey's KVKK you can ask what is kept about you, have it corrected or deleted, and object to its use. Write to barisakin@gmail.com; an answer comes within 30 days.